joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf7b588
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0xf7b590
mov eax, edx
pop esi
pop ebx
ret

Function at 0xfab9f4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0xfaba92
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0xfaba56
cmp byte [ebx + 0x11], 0
jne 0xfaba56
cmp byte [ebx + 0x3c], 0
jne 0xfaba56
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0xfaba77
lea edx, [ebp - 4]
mov eax, dword [0x140d530]
call fcn.00f0d170
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0xf86bcc]
call fcn.00f21d80
call fcn.00f08ce0
jmp 0xfaba77
lea edx, [ebp - 8]
mov eax, dword [0x140d530]
call fcn.00f0d170
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0xf86bcc]
call fcn.00f21d80
call fcn.00f08ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfaba99
lea eax, [ebp - 8]
mov edx, 2
call fcn.00f09644
ret

Function at 0xfac430
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0xfac47e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00fab874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xfac497
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0xfac4a0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00fab874
dec esi
jne 0xfac4c2
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x17866eaa
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7c165ccc
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4019ba
Capabilities:
Accept command line arguments
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call main
xor ebx, ebx
test eax, eax
jl 0x401bbd
mov ecx, dword [ebp - 0xc]
cmp ecx, 2
jl 0x401bbd
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
cmp byte [eax], 0x2d
jne 0x401bb4
cmp byte [eax + 2], bl
jne 0x401bb4
movzx eax, byte [eax + 1]
cmp eax, 0x6f
jg 0x401b7d
je 0x401b57
sub eax, 0x65
je 0x401b2e
dec eax
dec eax
je 0x401b2a
dec eax
dec eax
je 0x401b12
sub eax, 4
jne 0x401bb4
push esi
push edi
push ebx
push 1
mov esi, 0x40115c
push 0x80000002
push esi
lea ecx, [ebp - 0x44]
call fcn.004029a9
push ebx
lea ecx, [ebp - 0x44]
call fcn.00402b90
push ebx
push 1
push 0x80000001
push esi
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004029a9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x401678
push edi
call esi
test eax, eax
je 0x401add
push 0x401660
push edi
call esi
test eax, eax
je 0x401add
push 3
push 2
push 0x401198
lea ecx, [ebp - 0x28]
call fcn.00402b0f
lea eax, [ebp - 0x18c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x290]
push 0x40164c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x290]
lea ecx, [ebp - 4]
push eax
call fcn.00402061
jmp 0x401aee
push 3
push 1
push 0x401198
lea ecx, [ebp - 0x28]
call fcn.00402b0f
push ebx
push 2
push 1
lea ecx, [ebp - 4]
call fcn.0040230f
lea ecx, [ebp - 0x28]
call fcn.004029d8
lea ecx, [ebp - 0x44]
call fcn.004029d8
pop edi
pop esi
jmp 0x401bb4
add ecx, 0xfffffffd
lea eax, [edx + 0xc]
push ecx
push eax
push dword [edx + 8]
lea ecx, [ebp - 4]
call fcn.004028f5
jmp 0x401bb4
push 1
jmp 0x401ba9
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 0x5c]
and eax, 1
test al, al
je 0x401b50
cmp word [ebp - 0x58], bx
jne 0x401b50
push 1
pop eax
jmp 0x401b52
xor eax, eax
push ebx
push 1
jmp 0x401b7a
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x5c]
push 1
pop eax
and ecx, eax
test cl, cl
je 0x401b76
cmp word [ebp - 0x58], bx
je 0x401b78
xor eax, eax
push ebx
push ebx
push eax
jmp 0x401bac
sub eax, 0x71
je 0x401ba8
dec eax
je 0x401ba5
sub eax, 3
je 0x401b99
sub eax, 3
jne 0x401bb4
lea ecx, [ebp - 4]
call fcn.00401cf7
jmp 0x401bb4
push 1
lea ecx, [ebp - 4]
call fcn.00401e9f
jmp 0x401bb4
push ebx
jmp 0x401b9b
push ebx
push ebx
push 1
lea ecx, [ebp - 4]
call fcn.0040230f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401cf7
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
push edi
push 0
mov esi, ecx
push 0x4011a0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401d1d
push eax
mov ecx, esi
call fcn.0040224f
lea eax, [ebp - 0x140]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x244]
push 0x401750
push eax
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push 0x401720
push eax
call esi
add esp, 0x18
xor eax, eax
lea edi, [ebp - 0x3c]
push 0xf
pop ecx
rep stosd dword es:[edi], eax
and dword [ebp - 0x34], eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x348]
push 1
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x700
mov dword [ebp - 0x2c], 0x401710
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
leave
ret
Function at 0x401e9f
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 4], ecx
push 0x4011a0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x401ec9
mov ecx, dword [ebp - 4]
push eax
call fcn.0040224f
mov edi, 0x104
lea eax, [ebp - 0x46c]
push edi
push eax
call fcn.00401bc5
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x160]
push 0x4017bc
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x5c]
push ebx
push 1
push 0x80000001
push 0x40115c
call fcn.004029a9
cmp dword [ebp + 8], ebx
je 0x401f26
push 3
push 2
push 0x401198
lea ecx, [ebp - 0x5c]
call fcn.00402b0f
jmp 0x401f50
push ebx
push 0x401198
lea ecx, [ebp - 0x5c]
call fcn.00402b42
cmp eax, ebx
jne 0x401f4b
push 3
push 1
push 0x401198
lea ecx, [ebp - 0x5c]
call fcn.00402b0f
jmp 0x401f5f
cmp eax, 2
jne 0x401f5f
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x160]
push eax
call fcn.00402061
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x570]
push edi
push eax
push 0x4011b0
push 0x4011c4
push 0x4017ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x570]
push 0x4011d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402052
lea eax, [ebp - 0x368]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x264]
push 0x401750
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x264]
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x402052
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x674]
push 0x401774
push eax
call esi
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x40]
push 0xf
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x674]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 0x640
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x401710
mov dword [ebp - 0x24], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x402052
cmp dword [ebp - 8], ebx
je 0x402052
push 0x7530
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5c]
call fcn.004029d8
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402061
Capabilities:
Get file size
Read .ini file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
xor ebx, ebx
push esi
push ebx
push 1
push 0x80000002
push 0x401138
lea ecx, [ebp - 0x3c]
call fcn.004029a9
push ebx
lea ecx, [ebp - 0x3c]
call fcn.00402b90
push dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x1c], esi
push 0x41
push eax
push 0x401678
push 0x4017d4
push 0x4017cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x80], bl
je 0x40223f
cmp byte [esi], bl
je 0x40223f
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40223f
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x18], edi
je 0x402235
lea eax, [edi + 1]
push eax
call fcn.00402e44
mov esi, eax
pop ecx
cmp esi, ebx
je 0x402235
lea eax, [ebp - 0x20]
push ebx
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402235
mov eax, dword [ebp - 0x20]
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov byte [eax + esi], bl
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x401238
push esi
call fcn.00402c96
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
call fcn.00402c96
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x402216
cmp dword [ebp - 0xc], ebx
jne 0x4021bc
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4021bc
cmp dword [ebp - 8], eax
jbe 0x4021bc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x104]
mov edx, ecx
mov dword [ebp - 0xc], 1
mov cl, byte [ecx]
cmp cl, bl
je 0x4021ba
cmp cl, 0x27
je 0x4021a8
cmp cl, 0x22
jne 0x4021b1
mov byte [eax], cl
inc eax
mov byte [eax], cl
inc eax
mov byte [eax], cl
inc eax
mov byte [eax], cl
mov cl, byte [edx + 1]
inc eax
inc edx
jmp 0x40219a
mov byte [eax], bl
lea eax, [ebp - 0x10]
push ebx
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 4]
call fcn.00402c96
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x402175
sub esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push ebx
push eax
add esi, dword [ebp - 0x18]
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
lea ecx, [ebp - 0x3c]
call fcn.004029d8
mov eax, ebx
pop esi
pop ebx
leave
ret 4
Function at 0x402780
Capabilities:
Clear file content
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov dl, byte [0x4017ec]
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop esi
lea edi, [ebp - 0x24b]
mov ecx, esi
mov byte [ebp - 0x24c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x34f]
mov byte [ebp - 0x350], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x453]
mov byte [ebp - 0x454], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x147]
mov byte [ebp - 0x148], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00401bc5
push dword [ebp + 8]
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x148]
push 0x4018fc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x148]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, 0x4017cc
push eax
lea eax, [ebp - 0x24c]
push esi
push eax
push 0x4011b0
push 0x401970
push ebx
call edi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x350]
push esi
push eax
push 0x4011b0
push 0x40195c
push ebx
call edi
xor ebx, ebx
lea eax, [ebp - 0x148]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4028b8
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0xf
mov esi, 0x40191c
pop ecx
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x44]
push 0x3e
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x24c]
push eax
call esi
test eax, eax
jle 0x4028ee
lea eax, [ebp - 0x350]
push eax
call esi
test eax, eax
jle 0x4028ee
lea eax, [ebp - 0x350]
push ebx
push eax
lea eax, [ebp - 0x24c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402ad5
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x402b08
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00402ac7
mov eax, dword [esi + 4]
pop esi
ret 8

Function at 0x402b0f
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x402b3b
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00402ac7
mov eax, dword [esi + 4]
pop esi
ret 0xc
Function at 0x402b42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 4
cmp dword [esi + 8], 0
je 0x402b7f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
mov eax, dword [ebp + 0xc]
pop esi
jne 0x402b8c
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x10]
cmp dword [esi + 8], ebx
mov dword [ebp - 8], eax
je 0x402c13
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
push dword [esi + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x402bd3
cmp dword [esi + 0xc], ebx
je 0x402bda
cmp eax, 0xea
jne 0x402bfa
push dword [ebp - 8]
mov ecx, esi
call fcn.00402c2b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push dword [esi + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x402c22
cmp dword [ebp - 4], 1
je 0x402c13
cmp dword [ebp - 4], 2
je 0x402c13
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x402c22
cmp dword [ebp - 8], ebx
je 0x402c22
mov eax, dword [esi + 0xc]
jmp 0x402c25
lea eax, [esi + 0x18]
pop esi
pop ebx
leave
ret 4

Function at 0x40147e
Capabilities:
Encode data using xor

Disassembly:
xor dx, dx
mov esi, edi
lodsb al, byte [esi]
xchg cl, dl
ror al, cl
xor al, cl
xchg cl, dl
xor al, ah
stosb byte es:[edi], al
inc dx
loop 0x401483
ret

Function at 0x401494
Capabilities:
Encode data using xor

Disassembly:
xor dx, dx
mov esi, edi
lodsb al, byte [esi]
xor al, ah
xchg cl, dl
xor al, cl
rol al, cl
xchg cl, dl
stosb byte es:[edi], al
inc dx
loop 0x401499
ret
Function at 0x401bc1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx edx, byte [0x522e76]
movzx eax, byte [ebp - 8]
push ebx
mov ebx, dword [ebp - 8]
push esi
mov esi, ecx
mov dword [ebp - 4], 0x40
movzx ecx, byte [0x522e75]
cmp edx, esi
cmovb ecx, eax
mov eax, 0xc03
sub eax, dword [0x50a5b0]
mov byte [0x522e75], cl
sub eax, ebx
movzx eax, ax
mov dword [ebp - 8], eax
movzx eax, byte [0x50a5c0]
movzx ecx, bx
add ecx, 0x37
mov dword [0x50a5bc], ecx
sub ecx, eax
lea eax, [ebp - 4]
sub ecx, 0x4e
push eax
push 0x40
push 0x41fc
push dword [0x524b8c]
mov dword [0x50a5b0], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [0x522e79]
mov edx, dword [0x50a5bc]
cmp eax, edx
jbe 0x401c50
sub byte [0x522e73], bl
mov eax, dword [ebp - 8]
movzx eax, al
push 8
sub edx, eax
pop ecx
sub byte [ecx + 0x522e70], bl
dec ecx
cmp ecx, 4
jg 0x401c5b
pop esi
lea eax, [edx + 9]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a5844
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x509750]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x509750]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x30]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x20]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x48a916
mov al, byte [esi]
cmp al, 0x2b
je 0x48a911
cmp al, 0x2d
jne 0x48a916
xor edi, edi
inc edi
jmp 0x48a918
xor edi, edi
mov eax, dword [ebx + 0x14]
mov edx, 0x3000
and eax, edx
cmp eax, edx
je 0x48a92d
mov edx, 0x4ac8c0
jmp 0x48a94f
lea eax, [edi + 2]
mov edx, 0x4ac8c4
cmp eax, ecx
ja 0x48a94f
cmp byte [esi + edi], 0x30
jne 0x48a94f
mov cl, byte [esi + edi + 1]
cmp cl, 0x78
je 0x48a94d
cmp cl, 0x58
jne 0x48a94f
mov edi, eax
push edx
push esi
call fcn.00490350
mov dword [esp + 0x40], eax
push 0x2e
pop eax
mov word [esp + 0x20], ax
call fcn.0048fc50
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00490350
add esp, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
call fcn.0040192c
inc dword [ebx + 0x8024a4]
add byte [eax], al
add byte [eax - 0x18], dl
inc ecx
or dword [eax], eax
add byte [ebx + 0x84248c], al
add byte [eax], al
dec dword [ebx + 0x4c8d59f0]
and al, 0x2c
Function at 0x49e59c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x509750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004935e8
mov dword [ebp - 0x14], eax
cmp dword [0x5243e0], esi
jne 0x49e68f
push 0x800
push esi
push 0x4ab244
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49e61c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49e76f
push esi
push esi
push 0x4ab244
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49e76f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49e76f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x5243e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x5243e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5243e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5243f0], eax
test eax, eax
je 0x49e68c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5243ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x49e6b4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49e6a7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x49e6c9
push 4
pop eax
jmp 0x49e771
cmp dword [ebp - 0x14], esi
je 0x49e6c9
push dword [0x5243e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x49e6ae
mov eax, dword [0x5243ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49e727
cmp dword [0x5243f0], edi
je 0x49e727
push eax
call ebx
push dword [0x5243f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49e727
test eax, eax
je 0x49e727
call ecx
test eax, eax
je 0x49e71c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49e71c
test byte [ebp - 8], 1
jne 0x49e727
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49e757
mov eax, dword [0x5243e4]
cmp eax, edi
je 0x49e754
push eax
call ebx
test eax, eax
je 0x49e754
call eax
mov esi, eax
test esi, esi
je 0x49e754
mov eax, dword [0x5243e8]
cmp eax, edi
je 0x49e754
push eax
call ebx
test eax, eax
je 0x49e754
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5243e0]
call ebx
test eax, eax
je 0x49e76f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x49e771
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d1ee
mov esp, ebp
pop ebp
ret