joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9ca0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a9e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4a9e2e
mov dl, 1
mov eax, dword [0x42a0dc]
call fcn.00436e68
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00407430
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4a9e1d
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0048c3c8
test al, al
je 0x4a9e10
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4a9e5c
lea eax, [ebp - 0x394]
call fcn.004135b4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a9e10
xor eax, eax
push ebp
push 0x4a9e09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4a9ecc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a9df2
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407628
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4a9df2
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9e10
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4a9d13
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00436da4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9e54
lea eax, [ebp - 0x3a0]
call fcn.00407420
ret

Function at 0x4aa9ac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x54828c]
cmp byte [eax + 0xad], 0
jne 0x4aaa1e
cmp dword [0x5482a4], 0
jne 0x4aa9de
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x53fe58]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5482a4], eax
cmp dword [0x5482a0], 0
jne 0x4aa9f9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5482a0], eax
cmp dword [0x5482a8], 0
jne 0x4aaa1e
push esp
push 0
push 0
mov eax, dword [0x53fe54]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5482a8], eax
pop edx
ret
Function at 0x4aad44
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4aad5b
add esp, 0xfffffff0
call fcn.0040586c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043f8b0
mov eax, dword [0x5420cc]
cmp byte [eax], 0
jne 0x4aad88
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x5425ac]
cmp word [eax + 2], 0
jne 0x4aada2
mov eax, dword [0x5425ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ace3c
mov eax, dword [0x542748]
cmp word [eax + 2], 0
jne 0x4aadbc
mov eax, dword [0x542748]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ad04c
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44aa6c]
call fcn.0044fa74
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4ad5fc
mov dl, 1
mov eax, dword [0x4271bc]
call fcn.00405308
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4271bc]
call fcn.00405308
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44e104]
call fcn.0045686c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4aaf9c
mov eax, dword [0x5423b0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00456d00
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4ad8e4
mov dl, 1
mov eax, dword [0x4271bc]
call fcn.00405308
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5423b0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004133a8
test eax, eax
je 0x4aaecd
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413138
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041338c
test eax, eax
je 0x4aaee5
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00407628
push ebx
push 0x4ac80c
call fcn.004a0a54
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x5420cc]
cmp byte [eax], 0
jne 0x4aaf36
mov eax, ebx
call fcn.004ab110
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004adb10
mov eax, ebx
call fcn.004ae744
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4aaf93
call fcn.004058c4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ab3e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4ab486
cmp dword [ebx + 0x94], 0
jne 0x4ab480
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4ab330
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4ab480
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4ab446
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ab480
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00432dd8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4ab455
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ab6a4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x54828c]
cmp dword [eax + 0x170], 0
je 0x4ab809
test bl, bl
jne 0x4ab757
cmp dword [esi + 0x9c], 0
jne 0x4ab74c
mov eax, esi
call fcn.004ae594
push eax
push 0x4ab5b0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4ab71d
mov eax, dword [0x54828c]
cmp byte [eax + 0xd3], 0
je 0x4ab71d
mov eax, dword [esi + 0xd8]
call fcn.00408b78
mov edi, eax
cmp edi, 0
jl 0x4ab71d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ab706
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ab74c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432dd8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ab72c
inc dword [esi + 0x9c]
jmp 0x4ab809
cmp dword [esi + 0x9c], 0
jle 0x4ab809
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4ab809
cmp dword [esi + 0x44], 0
je 0x4ab7b4
mov eax, dword [0x54828c]
cmp byte [eax + 0xd3], 0
je 0x4ab7b4
mov eax, dword [esi + 0xd8]
call fcn.00408b78
mov edi, eax
cmp edi, 0
jl 0x4ab7b4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ab79d
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ab7e3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432dd8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ab7c3
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x49e92c]
call fcn.00408d38
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4ac458
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4ac4c3
cmp byte [ebx + 0xd3], 0
jne 0x4ac4c3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040756c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ac4b0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ac4d0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407430
jmp 0x4ac4d0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407430
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4adcf8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4add66
mov eax, esi
call fcn.00486380
test al, al
je 0x4add66
mov eax, dword [ebx + 0x84]
call fcn.00485fd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4add66
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4add5a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00485fd4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047cfa8
jmp 0x4add66
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004adb30
pop esi
pop ebx
ret
Function at 0x531678
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x531765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x531742
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e8]
mov edx, dword [ebp - 0xc]
call fcn.00432dd8
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, dword [ebx + 0x10]
call fcn.00407690
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00530c90
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x3dc]
lea eax, [ebp - 4]
call fcn.004078fc
mov eax, dword [ebp - 4]
call fcn.00412c84
test al, al
je 0x531736
xor eax, eax
push ebp
push 0x53172c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004074bc
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x531736
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x5316bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53176c
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00407428
lea eax, [ebp - 4]
call fcn.00407420
ret

Function at 0x5319b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407418
lea esi, [ebp - 0x238]
xor eax, eax
push ebp
push 0x531b0b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov eax, 2
call fcn.0052fd84
mov dword [ebp - 0xc], eax
mov dword [esi], 0x22c
xor eax, eax
push ebp
push 0x531ade
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0052fda4
mov ebx, eax
jmp 0x531abf
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 4]
call fcn.00412ea4
mov eax, dword [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00407628
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.00412ea4
mov eax, dword [ebp - 0x240]
pop edx
call fcn.00411a5c
test al, al
jne 0x531a9b
lea eax, [ebp - 0x248]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00407628
mov eax, dword [ebp - 0x248]
mov edx, dword [ebp - 4]
call fcn.00411a5c
test al, al
je 0x531ab3
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0052fdc4
mov ebx, eax
test ebx, ebx
jne 0x531a2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531ae5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x533468
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x67
push 0
push 0
dec ecx
jne 0x533470
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x2d4]
xor eax, eax
push ebp
push 0x533747
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x318]
xor eax, eax
call fcn.00404648
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
call fcn.00412e68
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 4]
mov ecx, 0x533760
call fcn.004078fc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004049f8
mov eax, esi
call fcn.00404790
call fcn.004043dc
mov edx, 0x53378c
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
mov edx, 0x5337ac
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x5337c4
lea edx, [ebp - 0x320]
xor eax, eax
call fcn.00404648
push dword [ebp - 0x320]
push 0x5337dc
lea eax, [ebp - 0x31c]
mov edx, 3
call fcn.004079e0
mov edx, dword [ebp - 0x31c]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x5337ec
lea edx, [ebp - 0x328]
xor eax, eax
call fcn.00404648
push dword [ebp - 0x328]
push 0x5337dc
push 0x533810
lea eax, [ebp - 0x324]
mov edx, 4
call fcn.004079e0
mov edx, dword [ebp - 0x324]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
mov edx, 0x533834
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x533850
push dword [ebx + 0x3dc]
push 0x53386c
push 0x533894
push dword [ebx + 0x3d8]
push 0x53386c
push 0x5337dc
lea eax, [ebp - 0x32c]
mov edx, 7
call fcn.004079e0
mov edx, dword [ebp - 0x32c]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x5338a8
push dword [ebx + 0x3d8]
push 0x53386c
push 0x5337dc
push 0x5338d4
lea eax, [ebp - 0x330]
mov edx, 5
call fcn.004079e0
mov edx, dword [ebp - 0x330]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x5337c4
push dword [ebx + 0x3dc]
push 0x53386c
push 0x5337dc
lea eax, [ebp - 0x334]
mov edx, 4
call fcn.004079e0
mov edx, dword [ebp - 0x334]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
push 0x5337c4
push dword [ebp - 4]
push 0x5337dc
lea eax, [ebp - 0x338]
mov edx, 3
call fcn.004079e0
mov edx, dword [ebp - 0x338]
mov eax, esi
call fcn.00407dd8
call fcn.00404e54
call fcn.004043dc
mov eax, esi
call fcn.00404abc
call fcn.004043dc
lea eax, [ebp - 0x310]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404ba0
mov dword [ebp - 0x310], 0x3c
mov dword [ebp - 0x30c], 0x40
xor eax, eax
mov dword [ebp - 0x308], eax
xor eax, eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 4]
call fcn.004074bc
mov dword [ebp - 0x300], eax
mov eax, 0x5338ec
mov dword [ebp - 0x2fc], eax
xor eax, eax
mov dword [ebp - 0x2f8], eax
xor eax, eax
mov dword [ebp - 0x2f4], eax
xor eax, eax
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x310]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53374e
lea eax, [ebp - 0x338]
mov edx, 0xa
call fcn.00407428
lea eax, [ebp - 4]
call fcn.00407420
ret
Function at 0x1262f59
Capabilities:
Check for trap flag exception

Disassembly:
jmp 0x1249573
pushfd
or dword [esp], reloc.RASAPI32.dll_RasDialA
popfd
rdtsc
nop
jmp 0x124958a
ret
mov ecx, dword [esp + 8]
lea edi, [ebx*4]
mov di, 0x5333
jmp 0x1262f89
mov si, ax
mov esi, dword [esp + 0x10]
lea esp, [esp + 0x14]
jmp 0x1249568
mov di, word [esp]
mov edi, dword [esp + 0xc]
mov esi, 0x85bc9eac
mov esi, 0x84086929
lea esi, [esi + esi]
mov esi, 0xd061dbde
jmp 0x1262f73

Function at 0x1287e72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.012884c2
nop
pop ss
xchg edx, esp
adc dword [edi + reloc.RASAPI32.dll_RasDialA], ebp
mov byte [edi], bh
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
stc
mov ah, 0x2d
mov ebp, 0xa6f637c4
lodsb al, byte ds:[esi]
retf
push esi
jmp fcn.01287f41
lea esp, [esp + 4]
sub esp, 0x18
jmp 0x1287e8e
mov dh, byte [esp + 1]
jmp 0x1287e5c
mov ecx, dword [esi]
pop esi
jmp 0x1287ede
push esi
mov esi, ebp
add esi, 8
jmp 0x1287e78
clc
xchg dh, dl
pushfd
mov edx, 0x10b
jmp 0x1287ec5
mov dl, 0x57
lea edx, [eax + ebx]
mov edx, 0x9a0809d1
add eax, ecx
lea edx, reloc.RASAPI32.dll_RasDialA
jmp 0x1287e96
lea esp, [esp + 4]
cmp word [eax + 0x18], dx
push bp
lea esp, [esp + 2]
jmp 0x1287f03
mov eax, dword [ecx + 0x3c]
mov edx, edi
mov dx, word [esp]
and dword [ebp - 0xc], 0
jmp 0x1287eb1
xor eax, eax
jmp 0x1287ca8
je 0x1287cce
clc
rol ax, 5
jmp 0x1287eed
Function at 0x13490b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
push word [esp + 0xa]
not bh
inc cx
jmp 0x134912b
xchg dword [esp + 0xa], ebp
bswap edx
bswap esi
and ebx, 0x2a8a1342
jmp 0x134910e
mov cx, word [esp + 0xb]
lea ecx, [edx + 0xf]
rdtsc
push word [esp + 7]
xchg dx, si
mov di, 0x7e19
jmp 0x13490e0
mov ecx, dword [esp + 0x10]
rcl ecx, 2
btc edx, esi
lea esp, [esp + 0xe]
pop bx
bsr eax, ebp
jmp 0x13491d4
rdtsc
lea esp, [esp + 1]
mov edx, dword [esp + 0xf]
mov cx, 0x58ba
lea esp, [esp + 8]
lea esp, [esp + 4]
jmp 0x13490f6
lea ebp, [edx*4]
call fcn.01349197
neg eax
push edi
not dx
mov ah, byte [esp + 0xc]
call fcn.013493a8
mov byte [esp + 7], dl
lea ebx, [esp + edx]
push word [esp + 7]
jmp 0x1349275
push word [esp + 0xc]
call fcn.01349222

Function at 0x1349197
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
cpuid
cld
rol bh, 2
rol dl, cl
shr cl, 1
jmp 0x1349181
xchg word [esp + 6], bp
lea eax, [ebx*4]
sub esp, 2
call fcn.013491bc
mov esi, 0x8b662889
je 0x1349190
mov si, word [esp + 2]
lea ebx, [ecx*4]
add cl, byte [ebp + 0x8d1c]
add byte [eax], al
mov dx, bx
mov cx, 0xf3c9
add esp, 2
cld
jmp 0x1349143
sub esp, 0xd
mov ecx, edi
setl bl
rdtsc
xchg di, bx
bsr edi, edi
jmp 0x1349151
invalid
pop bp
rdtsc
mov word [esp], di
add esp, 0
xchg edi, ebx
jmp 0x1349168

Function at 0x1349222
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ch
lea esp, [esp + 0x14]
mov byte [esp + 3], dh
cpuid
xchg word [esp + 3], bx
jmp 0x134920c

Function at 0x1349545
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.0134835d
pop word [esp]
jmp 0x134982d
mov eax, dword [eax + 8]
push eax
jmp 0x1348358
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x13495e8
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
mov eax, dword fs:[0x30]
jmp 0x134962b
Function at 0x402a7a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x4237b0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b0e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402acb
cmp dword [ebp + 0x10], ebx
jne 0x402b02
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a7a
test eax, eax
jne 0x402add
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ab2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406092
cmp eax, ebx
je 0x402b15
push ebx
push dword [0x4237b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b0e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4237b0], ebx
jne 0x402b0b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b0b
jmp 0x402b0e
Function at 0x402e9f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402ebc
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402ecb
mov ebx, 0x40e8c0
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ee0
mov ecx, dword [0x423758]
add ecx, eax
push ecx
call fcn.00403091
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.0040307b
test eax, eax
je 0x403032
test byte [ebp + 0x17], 0x80
je 0x40301b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40a830
mov dword [ebp - 0xc], eax
call fcn.00406175
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403071
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f30
mov esi, dword [ebp + 0x14]
mov edi, 0x40a8c0
push esi
push edi
call fcn.0040307b
test eax, eax
je 0x403032
sub dword [ebp + 0x14], esi
mov dword [0x40a848], edi
mov dword [0x40a84c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40a830
mov dword [0x40a850], ebx
mov dword [0x40a854], eax
call fcn.00406195
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x403013
mov esi, dword [0x40a850]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4237b4], 1
mov edi, eax
je 0x402fd2
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f9f
cmp dword [ebp + 0x14], 0
jne 0x402fd2
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x50]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.00404f12
mov dword [ebp - 0xc], edi
test esi, esi
je 0x403007
cmp dword [ebp + 0x10], 0
jne 0x402fef
push esi
push ebx
push dword [ebp + 0xc]
call fcn.00405a13
test eax, eax
je 0x403017
add dword [ebp - 4], esi
jmp 0x402ffb
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40a850]
cmp dword [ebp - 0x10], 1
jne 0x402f53
jmp 0x403071
cmp dword [ebp + 0x14], 0
jg 0x402f23
jmp 0x403071
push 0xfffffffffffffffc
jmp 0x403034
push 0xfffffffffffffffe
jmp 0x403034
test edi, edi
je 0x403066
cmp dword [ebp + 0x14], esi
jge 0x403027
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040307b
test eax, eax
jne 0x40306e
push 0xfffffffffffffffd
pop eax
jmp 0x403074
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403042
mov esi, dword [ebp + 0x14]
mov edi, 0x40a8c0
push esi
push edi
call fcn.0040307b
test eax, eax
je 0x403032
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405a13
test eax, eax
je 0x403017
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403037
jmp 0x403071
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10