joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4156b1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040f725
xor ebx, ebx
cmp dword [0x4be3f4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x415786
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4156f1
xor eax, eax
jmp 0x41584a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4156ea
push eax
call fcn.0040f6c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4be3f4], eax
call esi
push eax
call fcn.0040f6c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4be3f8], eax
call esi
push eax
call fcn.0040f6c2
mov dword [0x4be3fc], eax
lea eax, [ebp - 8]
push eax
call fcn.0040b290
test eax, eax
pop ecx
pop ecx
je 0x415754
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004082a5
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x415786
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040f6c2
cmp eax, ebx
pop ecx
mov dword [0x4be404], eax
je 0x415786
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f6c2
pop ecx
mov dword [0x4be400], eax
mov eax, dword [0x4be400]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4157ff
cmp dword [0x4be404], esi
je 0x4157ff
push eax
call fcn.0040f72e
pop ecx
call eax
cmp eax, ebx
je 0x4157cc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4be404]
call fcn.0040f72e
pop ecx
call eax
test eax, eax
je 0x4157cc
test byte [ebp - 0x18], 1
jne 0x4157ff
lea eax, [ebp - 0xc]
push eax
call fcn.0040b2c7
test eax, eax
pop ecx
je 0x4157e7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004082a5
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4157f6
or dword [ebp + 0x10], 0x200000
jmp 0x415830
or dword [ebp + 0x10], 0x40000
jmp 0x415830
mov eax, dword [0x4be3f8]
cmp eax, esi
je 0x415830
push eax
call fcn.0040f72e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x415830
mov eax, dword [0x4be3fc]
cmp eax, esi
je 0x415830
push dword [ebp - 4]
push eax
call fcn.0040f72e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4be3f4]
call fcn.0040f72e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418ee0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x418f1f
xor eax, eax
jmp 0x419007
mov word [ebp - 0x48], 0
push 0x3e
push 0
lea ecx, [ebp - 0x46]
push ecx
call fcn.004088d0
add esp, 0xc
mov dword [ebp - 0x150], 0
push 0xf4
push 0
lea edx, [ebp - 0x14c]
push edx
call fcn.004088d0
add esp, 0xc
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push 0
lea eax, [ebp - 0x54]
push eax
push 0x40
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418f8e
cmp dword [ebp - 0x54], 0x40
jne 0x418f8e
movzx eax, word [ebp - 0x48]
cmp eax, 0x5a4d
je 0x418f92
jmp 0x418fed
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0xc], eax
je 0x418fad
jmp 0x418fed
push 0
lea eax, [ebp - 0x54]
push eax
push 0xf8
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418fe2
cmp dword [ebp - 0x54], 0xf8
jne 0x418fe2
cmp dword [ebp - 0x150], 0x4550
je 0x418fe6
jmp 0x418fed
mov dword [ebp - 0x50], 1
cmp dword [ebp - 0x4c], 0xffffffff
je 0x419004
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret
Function at 0x419020
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00418e90
add esp, 4
test eax, eax
jne 0x419057
jmp 0x4190e7
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418ee0
add esp, 4
test eax, eax
jne 0x419069
jmp 0x4190e7
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x419090
jmp 0x4190e7
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4190af
jmp 0x4190e7
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4190cc
jmp 0x4190e7
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00418e30
add esp, 8
mov dword [ebp - 0xc], eax
xor ecx, ecx
jne 0x419042
cmp dword [ebp - 0x10], 0
je 0x4190fe
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x419115
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0xffffffff
je 0x41912c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x41d0eb
xor eax, eax
jmp 0x41d173
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [ebp - 4], 0x400000
jbe 0x41d106
mov dword [ebp - 0x14], 0x400000
jmp 0x41d10c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
cmp dword [ebp - 8], 0
jne 0x41d163
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41d173
cmp dword [ebp - 0x10], 0
jne 0x41d16b
jmp 0x41d171
cmp dword [ebp - 4], 0
ja 0x41d0f4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41d180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x41d19b
xor eax, eax
jmp 0x41d223
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [ebp - 4], 0x400000
jbe 0x41d1b6
mov dword [ebp - 0x14], 0x400000
jmp 0x41d1bc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
cmp dword [ebp - 8], 0
jne 0x41d213
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41d223
cmp dword [ebp - 0x10], 0
jne 0x41d21b
jmp 0x41d221
cmp dword [ebp - 4], 0
ja 0x41d1a4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41fa50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x41fa68
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x41fabb
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x41fa89
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x41faac
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x41fa80
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x4be4d0], eax
jmp 0x41fa5f
jmp 0x41fac6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x41fafe
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x4be0d0]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x4be4d0]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x4be4d0], edx
jmp 0x41fabd
mov dword [0x4c04d0], fcn.0041ccc0
call fcn.0041eb00
test eax, eax
jne 0x41fb1b
mov dword [0x4c04d0], 0x41dc60
mov esp, ebp
pop ebp
ret
Function at 0x423b70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x4a5850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call fcn.004246b0
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.004088d0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.open
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x40
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4a58b1
xor eax, eax
jmp 0x4a58c2
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4a5b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 0x14], eax
call fcn.00474220
mov dword [ebp - 4], str.SoftwareBaiduBaiduSd
mov dword [ebp - 0xc], str.SupplyID
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5bd4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a5bce
lea ecx, [ebp - 0x218]
push ecx
push 0x4b11ec
mov edx, dword [ebp + 8]
push edx
call fcn.004056a0
add esp, 0xc
jmp 0x4a5bd2
xor eax, eax
jmp 0x4a5be2
jmp 0x4a5bd8
xor eax, eax
jmp 0x4a5be2
call fcn.00471680
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret
Function at 0x4a5e20
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abc2e
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00427bd0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.004088d0
add esp, 0xc
mov dword [ebp - 0x228], 0
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x260]
call fcn.004042f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404270
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.004a5a60
add esp, 4
push 0x4b1174
lea ecx, [ebp - 0x260]
call fcn.004043b0
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x260]
call fcn.00404390
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404350
push 0
lea ecx, [ebp - 0x260]
call fcn.004043f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00404330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret
Function at 0x4a6650
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
jne 0x4a6671
xor al, al
jmp 0x4a66e1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a6687
xor al, al
jmp 0x4a66e1
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a66d4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a66c0
mov byte [ebp - 1], 1
jmp 0x4a66d4
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a66a5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret
Function at 0x4a7c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac0ad
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.004485d0
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004042a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x30]
push edx
mov ecx, 0x4c077c
call fcn.00404350
call fcn.00446860
cmp dword [0x4c0664], 0
jne 0x4a7d3a
push 0xed8
call fcn.00408493
add esp, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4a7ce9
mov ecx, dword [ebp - 0x38]
call fcn.004aa350
mov dword [ebp - 0x44], eax
jmp 0x4a7cf0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [0x4c0664], ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [0x4c0664]
add ecx, 8
call fcn.00404350
push 0x4afc98
mov ecx, dword [0x4c0664]
add ecx, 0x24
call fcn.00404370
mov eax, dword [0x4c0664]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x54], ecx
mov ecx, dword [0x4c0664]
call fcn.004aab80
call fcn.00444c20
call fcn.004a7260
test eax, eax
jne 0x4a7d9a
cmp dword [0x4c0664], 0
je 0x4a7d91
mov ecx, dword [0x4c0664]
call fcn.004aa170
mov edx, dword [0x4c0664]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4a7d80
push 1
mov ecx, dword [ebp - 0x3c]
call fcn.00406a10
mov dword [ebp - 0x48], eax
jmp 0x4a7d87
mov dword [ebp - 0x48], 0
mov dword [0x4c0664], 0
push 0
call fcn.0040b463
jmp 0x4a7d9f
call fcn.004a74e0
call fcn.004434b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00404330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret
Function at 0x4aa6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x220], ecx
call fcn.00474220
mov dword [ebp - 4], 0x4b0524
mov dword [ebp - 0xc], str.InstallDir
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa76a
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa764
lea ecx, [ebp - 0x218]
push ecx
push 0x4b056c
mov edx, dword [ebp + 8]
push edx
call fcn.004056a0
add esp, 0xc
jmp 0x4aa768
xor eax, eax
jmp 0x4aa778
jmp 0x4aa76e
xor eax, eax
jmp 0x4aa778
call fcn.00471680
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00408023
mov esp, ebp
pop ebp
ret 4
Function at 0x407710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e280]
jne 0x40771a
repz ret
jmp fcn.0040f20c

Function at 0x4151fd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b9cc
and dword [ebp - 4], 0
cmp dword [0x4342a8], 0
mov ebx, eax
jne 0x4152ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41535f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41535f
push eax
call fcn.0040b95a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4342a8], eax
call esi
push eax
call fcn.0040b95a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4342ac], eax
call esi
push eax
call fcn.0040b95a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4342b0], eax
call esi
push eax
call fcn.0040b95a
pop ecx
mov dword [0x4342b8], eax
test eax, eax
je 0x4152ae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b95a
pop ecx
mov dword [0x4342b4], eax
mov eax, dword [0x4342b4]
cmp eax, ebx
je 0x415306
cmp dword [0x4342b8], ebx
je 0x415306
push eax
call fcn.0040b9d5
push dword [0x4342b8]
mov esi, eax
call fcn.0040b9d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415306
test edi, edi
je 0x415306
call esi
test eax, eax
je 0x4152fd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4152fd
test byte [ebp - 0xc], 1
jne 0x415306
or dword [ebp + 0x10], 0x200000
jmp 0x41533f
mov eax, dword [0x4342ac]
cmp eax, ebx
je 0x41533f
push eax
call fcn.0040b9d5
pop ecx
test eax, eax
je 0x41533f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41533f
mov eax, dword [0x4342b0]
cmp eax, ebx
je 0x41533f
push eax
call fcn.0040b9d5
pop ecx
test eax, eax
je 0x41533f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4342a8]
call fcn.0040b9d5
pop ecx
test eax, eax
je 0x41535f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415361
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe2ea92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0xe2eb67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0xe2eb31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0xe2eb5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00e2eb71
test eax, eax
je 0xe2eb67
add ebx, 0x14
jmp 0xe2eb3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0xe2eb71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0xe2eddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0xe2eddd
mov eax, 1
test eax, eax
je 0xe2eddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0xe2eddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0xe2edd3
mov ebx, eax
and eax, 0x80000000
jne 0xe2ed4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0xe2eddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0xe2eddd
mov eax, 1
test eax, eax
je 0xe2eddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0xe2eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0xe2eca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0xe2eddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0xe2eb67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0xe2eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0xe2eca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc