joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003de90
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x1003df10
je 0x1003df01
cmp eax, 0x80000101
ja 0x1003defa
je 0x1003df01
cmp eax, 0x80000004
je 0x1003dedd
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x1003df25
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x1003df6b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x1003df6b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x1003df6b
cmp eax, 0x80000201
jne 0x1003df25
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x1003df6b
cmp eax, 0x80000401
je 0x1003df56
cmp eax, 0x80000501
je 0x1003df42
cmp eax, 0x80000601
je 0x1003df2e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.100433a8
jmp 0x1003df63
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.100433a8
jmp 0x1003df63
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.10041a10
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x1003e046
test ecx, ecx
je 0x1003e046
inc ecx
push esi
push ecx
call fcn.1004f1cd
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10043380
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1003dfe8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.advapi32.dll_RegCreateKeyExA_1]
test eax, eax
jne 0x1003e03c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA_1]
test eax, eax
jne 0x1003e031
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey_1]
push edi
call fcn.1004f1f6
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x1003e230
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1003e24e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1003e243
pop esi
ret
Function at 0x1003e250
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA_1]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x1003e2e2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x1003e2d4
mov ebp, dword [sym.imp.kernel32.dll_WriteFile_1]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1003e2cc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x1003e295
push edi
call dword [sym.imp.kernel32.dll_CloseHandle_1]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle_1]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x1003eb90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.10041a10
mov esi, dword [esp + 0x138]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], edx
test ebp, ebp
je 0x1003ec7e
test ecx, ecx
je 0x1003ec7e
inc ecx
push ebx
push ecx
call fcn.1004f1cd
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10043380
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1003ec12
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x1003ec66
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x1003ec53
cmp eax, 0xea
jne 0x1003ec5b
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey_1]
push ebx
call fcn.1004f1f6
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x114
ret
Function at 0x1003ec90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.10041a10
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x1003ede0
test ecx, ecx
je 0x1003ede0
inc ecx
push ecx
call fcn.1004f1cd
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10043380
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1003ed09
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x1003edcd
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.1004f1cd
add esp, 4
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x1003ed91
cmp eax, 0xea
jne 0x1003edb9
push esi
call fcn.1004f1f6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1004f1cd
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x1003ed5c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1003ed9f
cmp eax, 2
jne 0x1003edb9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.10041de0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.1004f1f6
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey_1]
push ebp
call fcn.1004f1f6
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x1003ee0e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1003ee1a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x1003ee1a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.10041de0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10041030
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
jne 0x10041049
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.10042570
add esp, 4
test eax, eax
jne 0x1004105e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, 1
jne 0x1004119e
mov edi, dword [esi + 4]
mov esi, dword [sym.imp.kernel32.dll_SetFilePointer_1]
push eax
push 0
push 0
push edi
mov dword [esp + 0x24], edi
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x1004109c
push 2
push 0
push 0
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0x1000
xor ebp, ebp
call fcn.10043a7b
add esp, 4
mov ebx, eax
lea eax, [esp + 0x20]
mov esi, ebx
push ebp
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.kernel32.dll_ReadFile_1]
test eax, eax
je 0x1004117e
mov edx, dword [esp + 0x20]
xor ecx, ecx
test edx, edx
jbe 0x100410e4
mov al, byte [esi]
cmp al, 0xd
je 0x10041126
cmp al, 0xa
je 0x10041126
inc ecx
inc esi
cmp ecx, edx
jb 0x100410d4
add ebp, edx
cmp edx, 0x1000
jb 0x10041128
push 0x1000
push ebx
call fcn.10043ebe
mov ebx, eax
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 0x1000
jne 0x10041128
lea ecx, [esp + 0x20]
push 0
lea esi, [ebx + ebp]
push ecx
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFile_1]
test eax, eax
je 0x1004117e
jmp 0x100410ca
add ebp, ecx
lea edx, [ebp + 1]
push edx
call fcn.1003d710
mov ecx, dword [esp + 0x14]
mov edi, eax
mov al, byte [esi]
add esp, 4
add ecx, ebp
cmp al, 0xd
je 0x10041146
cmp al, 0xa
jne 0x1004114f
mov al, byte [esi + 1]
inc ecx
cmp al, 0xa
jne 0x1004114f
inc ecx
mov eax, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer_1]
push ebp
push ebx
push edi
call fcn.10043dc0
push ebx
mov byte [edi + ebp], 0
call fcn.10043992
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 2
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer_1]
push ebx
call fcn.10043992
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x1004122c
mov esi, dword [esi + 4]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push 0
mov ecx, esi
call dword [eax + 0x30]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
test eax, eax
jbe 0x100411e7
mov cl, byte [ebp]
cmp cl, 0xd
je 0x100411e7
cmp cl, 0xa
je 0x100411e7
inc ebx
inc ebp
cmp ebx, eax
jb 0x100411d4
lea eax, [ebx + 1]
push eax
call fcn.1003d710
mov ecx, dword [esp + 0x18]
mov edi, eax
mov al, byte [ebp]
add esp, 4
add ecx, ebx
cmp al, 0xd
je 0x10041206
cmp al, 0xa
jne 0x1004120f
mov al, byte [ebp + 1]
inc ecx
cmp al, 0xa
jne 0x1004120f
inc ecx
mov edx, dword [esi]
push 0
push ecx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
call fcn.10043dc0
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10041430
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x10041446
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.10042570
add esp, 4
test eax, eax
jne 0x1004145d
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x1004150d
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSize_1]
mov ebp, dword [sym.imp.kernel32.dll_SetFilePointer_1]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x10041575
cmp edi, ebx
jae 0x10041575
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x10041575
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10041575
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.kernel32.dll_ReadFile_1]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x10041575
mov al, byte [esp + 0x24]
test al, al
je 0x1004156d
cmp al, 0x1a
jne 0x10041575
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x10041575
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.10042630
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x10041575
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x10041575
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10041575
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x10041575
mov al, byte [esp + 0x24]
test al, al
je 0x1004156d
cmp al, 0x1a
jne 0x10041575
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret

Function at 0x100415a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA_1]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10041609
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize_1]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.1003d710
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.kernel32.dll_ReadFile_1]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle_1]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x10051e2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10051e6c
call fcn.10054f06
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x10051e6c
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x10051e63
xor eax, eax
jmp 0x10051e74
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10051e7a
pop edi
pop esi
pop ebx
ret 4

Function at 0x401c15
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, esi
lea ebp, [0xbb6c8b19]
imul edi, esi, 0xc3740013
jne 0x401b28
add ecx, ebp
mov edi, 0xd794cc55
mov cl, bh
test edx, ebx
imul ecx, edi, 0x5888fcbd
imul ebx, esi
mov bh, 0x44
mov ebx, esi
lea edx, [ebx]
xchg bl, bl
mov ebx, 0xc46100bd
push edx
test edx, 0xcef5cc2
pop ecx
bswap ebx
mov ebx, 0x55267067
mov esi, ecx
mov cl, 0xc
cmp esi, ebp
jo 0x401b5f
inc edx
bswap ecx
lea ebx, [0xdb08b43]
lea edi, [0xe4d]
ja 0x401b75
xor bl, bh
imul edx, esi, 0x3b36fa16
xor edi, 0xe4d
xadd edi, esi
mov dl, 0x67
lea eax, [edi]
mov cl, bl
mov ecx, 0xf91def55
sub ebp, eax
movsx eax, bl
movzx ebx, dh
cmp ebp, 0x71dc
ja 0x401ba0
inc ecx
bswap edx
mov dl, al
je 0x401ba4
sub bh, ah
jmp 0x401bb8
call 0x401c15
cmp edi, 0xe815
js 0x401bca
and ch, 0x84
mov bh, 0xca
jbe 0x401bd2
test edx, 0xcd044571
mov bl, al
add eax, 0xe501
neg dl
sub eax, 0x5003
movsx edi, bx
imul edi, edi
mov al, ah
mov ebx, 0xd1d
or al, ch
xor ebx, 0xd1d
bswap ebp
neg dh
add ebx, 0xfffff393
movsx edi, bx
add ebx, 0xc6e
js 0x401c0b
inc edi
cmp ecx, edi
cmp ebx, 0xcd
jb 0x401bf5
and dl, 0xa
movzx eax, bl
cmp ecx, 0x50c4
pop ebx
movzx eax, bh
movzx edx, ch
cmp edi, 0xeeaf
mov edi, 0x6a4051c4
je 0x401c3d
xor dl, cl
dec edx
imul ebp, ebx
lea eax, [0x938ae38f]
mov esi, 0xfffffdc3
mov edi, 0x91520485
add esi, 0xeb8
dec esi
movsx eax, di
mov edx, edi
cmp esi, 0x46a
jae 0x401c54
movd mm2, ebx
movd ebp, mm2
mov bl, 0x9f
mov bl, dh
add ebp, 0x3ac0f
mov edi, 0xf127bc69
sub ebp, 0x738
test bl, ch
movsx ecx, bp
mov ebx, edx
add edx, ebp
imul ecx, ecx
imul ebx, ebx, 0xcc974f89
jbe 0x401c99
imul esi, ecx, 0x77da5e66
add bl, 0x43
push ebp
mov al, 0xb5
cmp esi, 0xe7bc
jbe 0x401cb0
test bl, ah
imul eax, eax, 0x76d8589b
cmp edx, 0x1bc7
test ch, dl
mov ah, 0xed
movzx eax, di
lea ebx, [0x80c]
js 0x401cc7
mov esi, edi
sub ebx, 0x80c
neg eax
dec edi
cmp ebp, edx
jo 0x401cdd
sub eax, 0xcc61ed96
or al, 0xc9
add ebx, 0x327
sbb dl, 0x30
sub ebx, 0x326
or ch, bl
xchg ecx, edx
test dl, 0xf4
cmp ebx, 0xf6c
jb 0x401ccd
sub edx, esi
ret
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str.FXOr
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401840
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov ecx, dword [0x438f08]
push esi
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x38]
mov eax, dword [0x438fb0]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 4]
push ecx
add edx, 0xfffffffb
push 0
mov dword [esp + 0x14], edx
mov edx, dword [0x438f08]
push 0x101b
push edx
mov dword [esp + 0x14], 0xf
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
call esi
push 0x4011
push 0x160
lea eax, [esp + 0x48]
push eax
push 0x10
push 0x428170
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [0x438f3c], eax
test eax, eax
jne 0x4018e9
pop esi
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00416a72
add esp, 0x1a8
ret
mov ecx, dword [0x438f08]
push eax
push 1
push 0x1003
push ecx
call esi
mov ecx, dword [esp + 0x1a4]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00416a72
add esp, 0x1a8
ret
Function at 0x401920
Capabilities:
Get file system object information
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
xor esi, esi
cmp byte [edi], al
je 0x401b11
cmp byte [edi + 0x400], al
lea ecx, [edi + 0x400]
je 0x4019a1
push 0x2c
push ecx
call fcn.004176b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40196d
mov byte [ebx], 0
push 0x4011
push 0x160
lea eax, [esp + 0x68]
push eax
push 0x80
lea eax, [edi + 0x400]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [esp + 0x64]
xor eax, eax
test ebx, ebx
je 0x4019a1
mov byte [ebx], 0x2c
mov edx, dword [0x438f08]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xc]
push ecx
push 0xffffffffffffffff
push 0x100d
push edx
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebx
cmp eax, 0xffffffff
jne 0x401b0c
cmp byte [edi + 0x800], 0
je 0x401a1a
cmp byte [0x432db8], 0
jne 0x401a1a
cmp byte [0x4329b8], 0
jne 0x401a1a
push edi
push 0x432db8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x800]
push eax
push 0x4329b8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 5
test esi, esi
je 0x401a36
mov dword [esp + 0x24], 7
push edi
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0
mov dword [esp + 0x44], eax
mov eax, dword [0x438f08]
push 0x1004
push eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], esi
call ebx
mov edx, dword [0x438f08]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x1007
push edx
mov dword [esp + 0x38], eax
call ebx
mov eax, dword [0x438fa4]
mov ecx, dword [0x438f20]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x438f20]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edx
call esi
mov eax, dword [0x438f08]
push 5
push eax
call esi
mov ecx, dword [0x438f0c]
push 0
push ecx
call esi
mov edx, dword [0x438f38]
push 5
push edx
call esi
cmp byte [0x432db8], 0
je 0x401ae4
cmp byte [0x4329b8], 0
je 0x401ae4
cmp dword [0x439008], 0
je 0x401ae4
mov eax, dword [0x438f30]
push 5
push eax
call esi
mov ecx, dword [0x438f04]
push 0
push 0xf060
push 0
push ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, dword [0x438f04]
call fcn.00405b70
mov eax, 1
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416a72
mov esp, ebp
pop ebp
ret
Function at 0x401b30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x438f04]
push esi
push edi
push 0
push 0xf060
push 0
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, dword [0x438f04]
call fcn.00405b70
mov ecx, dword [0x438f04]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x64
push ecx
call esi
mov edx, dword [0x438f04]
push 0xc8
push edx
call esi
mov eax, dword [0x438f0c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [0x438fac]
mov edx, dword [0x438f20]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x438f20]
push 5
push eax
call esi
mov ecx, dword [0x438f2c]
push 5
push ecx
mov dword [0x438f4c], 1
call esi
pop edi
mov eax, 1
pop esi
ret