joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b86a
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x44b8aa
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 0
push 0xe31
push 0x19b9
push dword [ebp - 0xc]
push 0x5314
push dword [ebp - 0x10]
push 1
call fcn.0044d23f
add esp, 0x1c
jmp 0x44b959
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44b951
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x44b904
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44b902
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x44b94f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x44b932
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x44b94f
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00433726
mov dword [eax], 5
jmp 0x44b927
jmp 0x44b959
push 0
call fcn.00449247
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44cb1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x44cc33
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44cbc2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44cba9
mov dword [ebp - 0x18], 0
push 1
lea eax, [ebp - 0x18]
push eax
push 0xa91
push 0
push 0
push 0x1814
push 0xf9e
push 0x7f96
call fcn.004527e3
add esp, 0x20
jmp 0x44cbc0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x44cc31
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44cc06
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x44cc04
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x44cc31
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.00433726
mov dword [eax], 8
jmp 0x44cc65
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
push 0x61d6
push dword [ebp - 0x5c]
push 0x1b84
push dword [ebp - 0x60]
push 0x5bad
push 1
push 1
push 0x284d
call fcn.00439486
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x45013a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x450231
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x45020b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4501e2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x4501aa
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x4501e0
mov byte [ebp - 1], 0
push 0x66c5
push 0x7724
lea eax, [ebp - 1]
push eax
push 1
push 0x52b
push 1
push 0x5e52
push 0
push 0
call fcn.0044ff6e
add esp, 0x24
jmp 0x45019f
jmp 0x450209
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x450209
push 0x24d5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x45022f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x450225
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x45022f
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x45025a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
call fcn.0043b742
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x450756
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4507d2
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x45078a
push 1
call fcn.0045080c
pop ecx
jmp 0x4507d0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4507c6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4507c4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x4507d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x450808
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 0x6bae
push 0x6480
push 0x307f
push 0x5ad6
push 0x32ad
push 0x4901
push dword [ebp - 0x20]
push 1
push 0xfce
call fcn.0043b6a5
add esp, 0x24
mov esp, ebp
pop ebp
ret

Function at 0x458a7d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x458b4c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x458b14
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x458af4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0xa
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x458b12
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x458b12
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x458b4a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0x66ea
push dword [ebp - 0x3c]
push 1
push 0x47e4
push 1
push 1
push 0x4d26
push 0x7691
push 0
call fcn.0044065f
add esp, 0x28
jmp 0x458b97
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x458b81
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0x2438
push 0x51fa
push 1
push dword [ebp - 0x48]
call fcn.0043be60
add esp, 0x10
jmp 0x458b97
push 0x14b3
push 1
push 0x1cd7
push 1
call fcn.0043bd61
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x49126a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x49f20f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b2484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0048f0c4
mov dword [ebp - 0x14], eax
cmp dword [0xaac430], esi
jne 0x49f302
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49f28f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49f3e2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49f3e2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49f3e2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaac430], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaac434], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaac438], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaac440], eax
test eax, eax
je 0x49f2ff
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaac43c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x49f327
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49f31a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x49f33c
push 4
pop eax
jmp 0x49f3e4
cmp dword [ebp - 0x14], esi
je 0x49f33c
push dword [0xaac430]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x49f321
mov eax, dword [0xaac43c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49f39a
cmp dword [0xaac440], edi
je 0x49f39a
push eax
call ebx
push dword [0xaac440]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49f39a
test eax, eax
je 0x49f39a
call ecx
test eax, eax
je 0x49f38f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49f38f
test byte [ebp - 8], 1
jne 0x49f39a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49f3ca
mov eax, dword [0xaac434]
cmp eax, edi
je 0x49f3c7
push eax
call ebx
test eax, eax
je 0x49f3c7
call eax
mov esi, eax
test esi, esi
je 0x49f3c7
mov eax, dword [0xaac438]
cmp eax, edi
je 0x49f3c7
push eax
call ebx
test eax, eax
je 0x49f3c7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaac430]
call ebx
test eax, eax
je 0x49f3e2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x49f3e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048e56b
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Check mutex on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x40501c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x4050b8
push 0x208
call fcn.00401a94
mov esi, eax
add esp, 8
test esi, esi
je 0x4011ce
push edi
push 0x208
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
push 0x105
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 0x403214
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x401102
mov edi, dword [ebp - 0x420]
xor ecx, ecx
nop dword [eax]
cmp ecx, 0x103
je 0x4010fc
mov eax, 0xcccccccd
mul edi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub edi, eax
mov ax, word [edi*2 + str.0123456789]
mov edi, edx
mov word [esi + ecx*2], ax
inc ecx
test edi, edi
jne 0x4010d0
xor eax, eax
mov word [esi + ecx*2], ax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x40113f
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4011ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.thsnYaVieBoda
push 0x104
push esi
call fcn.00401440
mov edi, str..pipe32B6B37A_4A7D_4e00_95F2_6F0BF3DE3E00
mov edx, 0x104
mov ecx, ebx
sub edi, ebx
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40116e
movzx eax, word [edi + ecx]
test ax, ax
je 0x40116e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x401150
test edx, edx
lea eax, [ecx - 2]
pop edi
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
je 0x4011ce
push esi
push 0x104
push ebx
call fcn.00401440
test eax, eax
js 0x4011ce
push esi
call fcn.00401a8f
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401aa0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40112f
cmp dword [ebp + 0xc], 0
jne 0x40112f
push str.TsnIorcAeBoda
jmp 0x401134
mov ecx, dword [ebp - 4]
mov eax, 8
pop esi
xor ecx, ebp
pop ebx
call fcn.00401aa0
mov esp, ebp
pop ebp
ret
Function at 0x4011f0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x401213
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401248
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401248
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40123d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401248
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x401285
push 0x4050b8
push 0x208
call fcn.00401a94
mov esi, eax
add esp, 8
test esi, esi
je 0x401285
push 0x208
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 0
push esi
call section..text
add esp, 0x14
test eax, eax
je 0x40128a
push esi
call fcn.00401a8f
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3e8
jae 0x40129c
add eax, 0x3e8
push ebx
push 1
push eax
push esi
call fcn.00401300
xor ebx, ebx
add esp, 0xc
test eax, eax
sete bl
test eax, eax
jne 0x4012e7
push edi
mov edi, dword [ebp + 8]
cmp edi, 2
je 0x4012e6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 1
jne 0x4012d3
push 0
push 0xce
jmp 0x4012dd
test edi, edi
jne 0x4012e6
push edi
push 0xcc
push esi
call fcn.00401300
add esp, 0xc
pop edi
push esi
call fcn.00401a8f
add esp, 4
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x401300
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push esi
push 0x190000
push 3
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40133f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0xd
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x401373
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push 4
lea eax, [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401394
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xd
test esi, esi
push ebx
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], esi
je 0x401423
push edi
mov dword [ebp - 8], esi
xor edi, edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4013eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xd
test esi, esi
cmove esi, eax
cmp esi, 0xe8
jne 0x4013f6
push 0xa
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xa
jl 0x4013a3
jmp 0x4013f6
cmp dword [ebp - 4], 4
je 0x4013fa
mov esi, 0xd
test esi, esi
jne 0x401422
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 8]
inc ecx
cmp eax, ecx
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 0xc]
mov esi, 0xd
push eax
push 4
lea eax, [ebp - 4]
cmove esi, edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x40501c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x210], 0
call sub.VCRUNTIME140.dll_memset
mov bx, word [ebp + 0x10]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x214], 0
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x218], 0
sete al
mov dword [ebp - 0x21c], 4
movzx esi, ax
lea eax, [ebp - 0x20c]
test bx, bx
je 0x401581
push str.SoftwareAdobeAcrobat_ReaderDCFeatureState
jmp 0x401586
push str.SoftwareAdobeAdobe_AcrobatDCFeatureState
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401653
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 0x220]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40161e
cmp dword [ebp - 0x214], 4
jne 0x40161e
push dword [ebp - 0x210]
xor ebx, ebx
cmp dword [ebp - 0x218], ebx
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401aa0
mov esp, ebp
pop ebp
ret
cmp word [ebp + 0x10], 0
mov ebx, esi
je 0x401633
test edi, edi
je 0x401633
mov eax, 1
mov word [edi], ax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401aa0
mov esp, ebp
pop ebp
ret
mov eax, esi
test bx, bx
je 0x401668
test edi, edi
je 0x401668
mov eax, 1
mov word [edi], ax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401aa0
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2f1024e1
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x2da81fcd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73a899
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004446e0
mov al, byte [esp + 0xb]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x2c], al
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov cl, byte [esp + 0xb]
mov byte [esp + 0x18], 1
mov byte [esi + 0x3c], cl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dl, byte [esp + 0xb]
mov byte [esp + 0x18], 2
push 0xc
mov byte [esi + 0x6c], dl
call fcn.00726f70
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ebx
or eax, 0xffffffff
lea edx, [esi + 0x88]
mov byte [esp + 0x18], 3
xor ecx, ecx
mov dword [esi], fcn.00401ae0
mov dword [esi + 0x78], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov word [esi + 0x58], 1
mov dword [esi + 0x64], eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea edx, [esi + 0x98]
mov dword [esi + 0x98], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0xa8], 1
mov byte [esi + 0xb4], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0x60], 2
mov dword [esi + 0x5c], ebx
mov word [esi + 0x5a], bx
mov dword [esp + 0x18], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret