joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x4142c3
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4142b5
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4142d4
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x1c]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.004e1f00
add dword [edi + 0x24], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x41433b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414336
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x414368
mov ebx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x41434c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x1c]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.004e1f00
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x24], eax
cmp edi, 1
jne 0x41437c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x414373
cmp byte [esi + 8], 0
je 0x414373
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x415606
cmp dword [edi + 4], 0xffffffff
jne 0x415606
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x415575
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x4155a1
cmp eax, 0x2f
je 0x4155a1
mov dword [edi + esi*2 + 0x244], 0x2f
mov esi, dword [ebp + 0x10]
cmp esi, 1
jne 0x4155c3
mov ecx, dword [ebp + 8]
call fcn.004118c0
cmp eax, 0xffffffff
jne 0x4155c3
mov eax, 0x2000000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.00413fd0
add esp, 8
test eax, eax
jne 0x4155e7
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.004146a0
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415c50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x541074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x415cf1
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004e9f3c
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415c90
sub ecx, edx
sar ecx, 1
je 0x415cd0
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x415cb3
cmp eax, 0x5c
jne 0x415cd0
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x415df4
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415cf1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x415de4
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x415d0e
cmp ax, 0x5c
jne 0x415d10
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x415d02
cmp esi, edi
je 0x415d59
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call fcn.004e1f00
add esp, 0xc
cmp esi, 0x208
jae 0x415df4
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.00415c50
xor eax, eax
mov word [ebp - 0x418], ax
pop esi
test ebx, ebx
je 0x415d7c
push 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.004e9f3c
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x418]
mov word [ebp - 0x212], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415d90
sub ecx, edx
mov eax, 0x104
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x418]
lea eax, [eax + ecx*2]
push edi
push eax
call fcn.004e9f3c
xor eax, eax
add esp, 0xc
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415de4
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004c8882
mov esp, ebp
pop ebp
ret
call fcn.004c8c90
int3
Function at 0x416920
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x4169f8
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x416954
cmp dword [esi + 0x40], ebx
jae 0x416954
push eax
call fcn.004c8d6c
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x41696c
lea eax, [ebx + ebx]
push eax
call fcn.004c8b41
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.004e1f00
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x4169f5
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x51d618]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x51d618]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x416982
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x416a36
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x416a1d
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.004e1f00
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x416a58
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4181d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x418211
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.004e2480
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.00417750
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.004e2480
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.00417750
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.004e2480
add esp, 0x1c
pop edi
pop esi
ret

Function at 0x418300
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x541074]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [ebp - 0x9c], 0x67452301
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x98], 0xefcdab89
mov dword [ebp - 0x94], 0x98badcfe
mov dword [ebp - 0x90], 0x10325476
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
call fcn.00418120
add esp, 4
lea edx, [ebp - 0xa4]
mov ecx, esi
call fcn.004181d0
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.004c8882
mov esp, ebp
pop ebp
ret
Function at 0x41c090
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x541074]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push reloc.d2d1.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c10f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8882
mov esp, ebp
pop ebp
ret

Function at 0x41c240
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505028
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x541074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x41c2b7
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41c2b0
mov edi, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
je 0x41c2b0
mov ecx, edi
xor esi, esi
call fcn.004092f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x41c2cc
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00403ab0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c2e0
Capabilities:
Hide graphical window
Log keystrokes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0x41c42b
push 0
push 0
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x41c424
mov eax, dword [esi]
mov ebx, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x41c3ce
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c3ce
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push esi
push ebx
call edi
mov esi, dword [ebp - 4]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp - 4]
call esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 8]
push ebx
call edi
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov bl, 1
jmp 0x41c42d
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41c3e6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebx + 3]
cmp ecx, eax
jb 0x41c3e6
mov bl, 1
jmp 0x41c42d
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41c41d
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41c42b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x41c41a
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
jmp 0x41c425
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x41c442
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403ab0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004e2480
add esp, 0xc
mov dword [ebp - 0x38], 0x40
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov dword [ebp - 0x30], 0x51bb8c
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0x1c]
mov esi, eax
cmp ecx, 8
jb 0x41c4c0
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403ab0
xor eax, eax
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
cmp eax, 8
jb 0x41c4e9
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00403ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41cf60
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5051a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x541074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test cl, cl
mov dword [ebp - 4], 1
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x28]
je 0x41cfbf
call fcn.00402d60
push ecx
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0x20]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea edx, [ebp - 0x28]
call fcn.00420c20
add esp, 0xc
jmp 0x41cfd8
call fcn.00402d60
push ecx
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x28]
call fcn.00420a50
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41cfed
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403ab0
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x41d002
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00403ab0
xor eax, eax
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
cmp eax, 8
jb 0x41d02b
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00403ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c8882
mov esp, ebp
pop ebp
ret
Function at 0x41f590
Capabilities:
Create thread

Disassembly:
cmp dword [0x5480b0], 0
push esi
mov esi, ecx
jne 0x41f5a0
xor al, al
pop esi
ret
mov ecx, dword [esi + 0xa0c]
test ecx, ecx
je 0x41f5d6
mov eax, dword [ecx]
cmp eax, vtable.ui::Option.0
jne 0x41f613
mov al, byte [ecx + 0x334]
test al, al
jne 0x41f5d6
push 0
push 0x52014c
push 0x520154
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
pop esi
ret
mov ecx, dword [esi + 0xa2c]
test ecx, ecx
je 0x41f5ea
mov eax, dword [ecx]
push 1
call dword [eax + 0x278]
mov esi, dword [0x5480b0]
cmp dword [esi + 0x10], 0
jne 0x41f60f
push 0
push 0
push esi
push 0x41d050
push 0
push 0
call fcn.004ea340
add esp, 0x18
mov dword [esi + 0x10], eax
mov al, 1
pop esi
ret
mov eax, dword [eax + 0x130]
call eax
jmp 0x41f5b9
Function at 0x41ffa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
cmp dword [ebx + 0x14], 8
mov ecx, dword [ebx + 0x10]
mov dword [ebp + 0xc], ecx
jb 0x41ffc1
mov esi, dword [ebx]
jmp 0x41ffc3
mov esi, ebx
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x41ffe5
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x41ffd1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov esi, dword [ebp - 4]
and ecx, edx
mov edx, dword [eax + 0xc]
mov esi, dword [esi + 4]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov dword [ebp - 4], esi
mov edi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0xc], edi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0x10], ecx
cmp edi, esi
jne 0x420010
mov ecx, esi
jmp 0x420014
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4200f1
cmp dword [ebx + 0x14], 8
lea edx, [eax + 8]
jb 0x420029
mov esi, dword [ebx]
jmp 0x42002b
mov esi, ebx
cmp dword [edx + 0x14], 8
lea ecx, [edx + 0x10]
jb 0x420036
mov edx, dword [edx]
mov ecx, dword [ecx]
mov edi, dword [ebp + 0xc]
cmp ecx, edi
mov dword [ebp - 8], ecx
cmovb edi, ecx
test edi, edi
jne 0x420066
xor ecx, ecx
test ecx, ecx
jne 0x420059
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
cmp ecx, edx
jb 0x420059
jbe 0x420087
mov eax, dword [eax]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
jmp 0x420008
mov cx, word [edx]
cmp cx, word [esi]
jne 0x420079
add edx, 2
add esi, 2
sub edi, 1
jmp 0x420045
movzx ecx, word [edx]
cmp cx, word [esi]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x420049
cmp dword [eax + 0x1c], 8
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x420095
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
jb 0x42009d
mov ebx, dword [ebx]
mov edi, dword [edi]
mov esi, edi
cmp dword [ebp + 0xc], edi
cmovb esi, dword [ebp + 0xc]
test esi, esi
jne 0x4200d0
xor ecx, ecx
test ecx, ecx
jne 0x4200bb
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
jb 0x4200bb
jbe 0x4200be
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
mov cx, word [ebx]
cmp cx, word [edx]
jne 0x4200e3
add ebx, 2
add edx, 2
sub esi, 1
jmp 0x4200aa
movzx ecx, word [ebx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x4200ae
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x420490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x4204ab
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4204c7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4204b6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4204fd
cmp dword [ecx], edi
jne 0x4204f5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x420505
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x420505
cmp dword [ecx], edi
jne 0x420508
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00420850
push edi
call fcn.004c8b2e
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x420a50
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov esi, edx
call fcn.004209c0
add esp, 4
test al, al
jne 0x420a70
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, 0xf003f
call fcn.004208b0
test al, al
mov dword [ebp - 4], 0
mov ecx, 0xf013f
cmovne edi, ecx
cmp dword [esi + 0x14], 8
jb 0x420a94
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
test eax, eax
je 0x420ab3
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x420abe
mov eax, dword [eax]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x420ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], edx
mov bl, 1
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 8], esi
lea edi, [esi + 1]
mov dword [ebp - 0xc], esi
cmp dword [0x548c5c], esi
jne 0x420b28
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x548c5c], eax
test eax, eax
je 0x420b39
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x548c5c]
cmp dword [ebp - 0xc], edi
mov eax, 0x101
mov ecx, dword [ebp - 0x10]
cmove edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
call fcn.00402c40
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x420b6a
xor bl, bl
jmp 0x420bf9
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, edi
call fcn.00402c40
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x420b90
xor bl, bl
jmp 0x420bf9
push dword [ebp - 4]
call fcn.004e7902
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.004e2480
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, edi
push eax
push esi
push 0
push 0
call fcn.00402c40
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x420bca
xor bl, bl
jmp 0x420bf9
cmp word [esi], 0
jne 0x420bd4
xor ecx, ecx
jmp 0x420bef
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420be0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00402f90
mov eax, dword [ebp - 8]
test eax, eax
je 0x420c07
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x420c14
push esi
call fcn.004e7744
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret