joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d616
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061508
call fcn.10060588
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x1c], 0x2466
xor esi, esi
cmp dword [ebp - 0x1c], 0x280f
push edi
mov dword [ebp - 0x10], esp
jle 0x1001d683
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, ebx
mov esi, edi
mov edi, dword [ebp - 0x20]
sar esi, cl
mov eax, esi
mov ecx, 0x1007cb18
xor eax, edi
cdq
push edx
push eax
call fcn.10010bb7
inc edi
cmp edi, 0x75d8
jl 0x1001d64e
mov edi, dword [ebp - 0x18]
inc ebx
push 0
pop esi
cmp ebx, 0x439a
jl 0x1001d642
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x410b
jl 0x1001d640
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x2304
jge 0x1001d69e
mov edx, str.zypie_gdwbuljlq_xonrug_rldbyoubp_uvznro_lyqhcorc_rau_trgpm_sypx_rgx_sntcxbwlp_bieh_nhwialupv
mov ecx, 0x1007cb18
call fcn.100134d2
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1001d77e
mov dword [ebp - 0x20], 0x47f7
cmp dword [ebp - 0x20], 0x4acb
jle 0x1001d724
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x1a02
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d6e6
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.10001516
dec edi
dec dword [ebp - 0x1c]
jne 0x1001d6cd
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x517
jl 0x1001d6c3
inc ebx
cmp ebx, 0x7425
jl 0x1001d6be
push 0x85c
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x20], 0x463c
jge 0x1001d738
push str.exd_osygrphys_ldqiko_oyfbmnvu_ovnrm_zfhc_erjgbvqtu_dpwnez_ilnmrv_ibtf_jwnintt_ftao
call fcn.10048d40
pop ecx
mov edx, dword [ebp + 0x24]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x1001d79d
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd3f5047c
inc dword [edx]
cmp dword [edx], 2
jl 0x1001d745
jmp 0x1001d79d
mov edx, dword [ebp + 0x20]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x1001d79d
mov esi, dword [ebp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbebf0a0c
inc dword [edx]
cmp dword [edx], 2
jl 0x1001d78b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d9e5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061524
call fcn.10060588
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x10], bl
je 0x1001da39
push 2
pop edi
mov dword [esi], edi
jmp 0x1001da30
mov dword [ebp - 0x18], 0x276b87d0
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001da2e
push ecx
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push eax
push ecx
call fcn.1001c553
add esp, 0x10
dec dword [ebp - 0x18]
jns 0x1001da17
dec dword [esi]
cmp dword [esi], ebx
jge 0x1001da08
jmp 0x1001dafc
mov dword [ebp - 0x18], 0x5240
cmp dword [ebp - 0x18], 0x560b
jle 0x1001da70
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007cb18
xor eax, esi
cdq
push edx
push eax
call fcn.10010bb7
inc edi
cmp edi, 0x27b7
jl 0x1001da4d
inc esi
cmp esi, 0x781
jl 0x1001da4b
push 4
lea ecx, [ebp - 0x28]
call fcn.100013b5
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0x5235
jge 0x1001dab7
mov edx, str.txwzjmbku_xbismas_egnsoz
mov ecx, 0x1007cb18
call fcn.100134d2
jmp 0x1001dab7
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1001dad2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001dac6
push ebx
lea eax, [ebp - 0x1c]
mov dl, 1
push eax
push ebx
mov ecx, 0x34fe
call fcn.1001bdc6
add esp, 0xc
cmp dword [ebp - 0x28], 0
je 0x1001dafc
push dword [ebp - 0x28]
call fcn.10048e11
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ef91
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061580
call fcn.10060588
sub esp, 0x14
cmp byte [ebp + 0xc], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
je 0x1001efd2
push ecx
push ecx
xor dl, dl
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
call fcn.1001e3fd
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x690f
cmp dword [ebp - 0x18], 0x6b04
jle 0x1001f01c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007cb18
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10010bb7
inc ebx
cmp ebx, 0x18c5
jl 0x1001efe8
inc edi
cmp edi, 0x56a0
jl 0x1001efe6
inc esi
cmp esi, 0x699d
jl 0x1001efe4
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x1001f05b
push 0xb7b
push 0x4cb3
push ecx
push 0x588f
push 0x2062
push 0x47a0
push ecx
push ecx
push 0
push 0x111
push 0x1a8b
mov edx, 0x7c88
mov ecx, 0x30fe
call fcn.1001b61b
add esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x66e8
jge 0x1001efc1
mov edx, str.psw_elo_fpu_kkroy_zagbxml_akzyolj_opvtqnzj_jxfanely_egatm_lsxqojobo_xtl_clgquyl_ltnku_kauzslo
mov ecx, 0x1007cb18
call fcn.100134d2
jmp 0x1001efc1
Function at 0x1001f0ad
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006158a
call fcn.10060588
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x28], 0x7d81
mov esi, 0x1007cb18
cmp dword [ebp - 0x28], 0x7feb
push edi
mov dword [ebp - 0x10], esp
jle 0x1001f13e
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cdq
idiv ecx
mov ecx, ebx
mov eax, edi
sub ecx, edx
shl eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.10010bb7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0xee0
jl 0x1001f0e3
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x4f15
jl 0x1001f0de
inc ebx
cmp ebx, 0x7031
jl 0x1001f0d9
inc edi
cmp edi, 0x7021
jl 0x1001f0d7
push 0
push 0x693
push 0xf15
push 0x745
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
cmp byte [ebp + 0xc], 0
je 0x1001f209
mov dword [ebp - 0x24], 0x697
cmp dword [ebp - 0x24], 0x813
jle 0x1001f1a8
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x33b3
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, ebx
mov ecx, esi
or eax, edi
cdq
push edx
push eax
call fcn.10010bb7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x761
jl 0x1001f16e
inc ebx
cmp ebx, 0x4559
jl 0x1001f169
dec edi
dec dword [ebp - 0x18]
jne 0x1001f167
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x1acf
jl 0x1001f15d
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x44a
jge 0x1001f1e2
mov edx, str.looqjt_eaxkiyl_wzfri_kxt_ewifc_udj_qifyrya_xrsu_rrhfbthx_serkkvhtu_vldsutaes_lvvmq_gwlbhnazf_jyboi
mov ecx, esi
call fcn.100134d2
jmp 0x1001f1e2
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x1001f2a7
push 1
push 0x4ce5
mov dl, 1
xor cl, cl
call fcn.1001e7a4
pop ecx
pop ecx
jmp 0x1001f2a7
mov dword [ebp - 0x1c], 0x36de
cmp dword [ebp - 0x1c], 0x37fb
jle 0x1001f258
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 0x7138
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.10010bb7
dec edi
dec dword [ebp - 0x24]
jne 0x1001f22a
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x358b
jl 0x1001f220
inc ebx
cmp ebx, 0x474a
jl 0x1001f21b
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x3531
jge 0x1001f299
mov edx, str.xmvfe_vfqdxwvnn_pvsqca_aqrmxiqzz_xlmojzm_xsglzq_ecynjbj_pmfygg_cjymzf_bknnqymbm_obj_cjzhozvjb_hherghd
mov ecx, esi
call fcn.100134d2
jmp 0x1001f299
cmp byte [ebp - 0x11], 0
je 0x1001f2a7
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x28], 0x7a52
jge 0x1001f2c3
mov edx, str.aqtreupfz_jathmrwth_gxq_fvdrrrq_lslj_qeq_ukciuuthp_djttub_ujteisky_kwpgelb_fvbrskprd_cqtddr_prujlvxag
mov ecx, esi
call fcn.100134d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028488
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100619c3
call fcn.10060588
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x14], dl
mov edx, ecx
mov dword [ebp - 0x10], esp
je 0x10028584
mov dword [ebp - 0x24], 0x5952
xor esi, esi
cmp dword [ebp - 0x24], 0x5ce6
jle 0x1002852d
push 0x463
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], 0x5d2c
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x18], 0x7edb
mov esi, dword [ebp + 8]
mov eax, esi
mov ecx, 0x1007cb18
xor eax, edi
cdq
push edx
push eax
call fcn.10010bb7
add edi, ebx
dec dword [ebp - 0x18]
jne 0x100284e6
inc ebx
push 0
pop esi
cmp ebx, 0x7760
jl 0x100284da
dec dword [ebp + 8]
dec dword [ebp - 0x1c]
jne 0x100284d8
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x4489
jl 0x100284ce
push esi
push 0x1cc0
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x5918
jge 0x10028566
mov edx, str.mkmx_qhf_hnrebo_wbdvq
mov ecx, 0x1007cb18
call fcn.100134d2
jmp 0x10028566
cmp byte [ebp - 0x14], 0
je 0x10028575
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x100285b9
push 0x463
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x100285b9
cmp byte [ebp + 0xc], 0
je 0x10028599
push 0
push 0x11a
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x100285b9
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100285b9
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x313dd33a
inc dword [edx]
cmp dword [edx], 3
jl 0x100285a7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042720
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062260
call fcn.10060588
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x20], 0x6913
cmp dword [ebp - 0x20], 0x6cd6
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x1004277d
xor esi, esi
xor edi, edi
mov dword [ebp - 0x14], 0x4d90
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007cb18
xor eax, ebx
cdq
push edx
push eax
call fcn.10010bb7
inc ebx
cmp ebx, 0x63c9
jl 0x10042753
add edi, esi
dec dword [ebp - 0x14]
jne 0x10042751
inc esi
cmp esi, 0x7a39
jl 0x10042748
cmp byte [ebp + 0xc], 0
je 0x10042832
mov dword [ebp - 0x1c], 0x206d
cmp dword [ebp - 0x1c], 0x23e8
jle 0x10042812
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x24], edi
and edi, esi
xor esi, esi
mov eax, edi
lea ecx, [ebp - 0x40]
xor eax, esi
xor eax, ebx
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100427c5
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10001516
inc esi
cmp esi, 0x3b5f
jl 0x100427aa
inc ebx
cmp ebx, 0x6be4
jl 0x100427a8
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1485
jl 0x100427a1
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x641b
jl 0x1004279c
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
cmp dword [ebp - 0x1c], 0x1e87
jge 0x10042826
push str.bkkz_dtfrijfnk_qqjmomdw_shydsug_uxsuewlj_vovxb_alkik_lzqyqog_hjavhnec_zdqyjfm_qzuoxlkzi_aqyo_tcjhvs_nzswnkaws
call fcn.10048d40
pop ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x10042842
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x10042842
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6858
jge 0x10042861
mov edx, str.oebif_kaf_bqfn_rriw_zjorvz_xkd
mov ecx, 0x1007cb18
call fcn.100134d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100429b2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100429c9
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x100429eb
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007e934
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007ecc0
jl 0x100429f9
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007ef64
jl 0x10042a39
mov ecx, dword [0x1007fcb0]
xor ecx, dword [0x1007e934]
and ecx, edi
xor ecx, dword [0x1007fcb0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007e930], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007ef64]
mov dword [0x1007f2f0], eax
pop esi
ret
Function at 0x406580
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4262b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x11c]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4065a1
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
lea eax, [ebp - 0x11c]
push 0x41aaf4
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0xc
test eax, eax
je 0x4066b3
cmp byte [eax + 7], 0
jne 0x4066b3
push ebx
push 0
push 0x20000080
push 3
push 0
push 0
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406621
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
jne 0x406633
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x120], edi
test edi, edi
jne 0x40666e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x124]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push edi
call fcn.00404fb0
add esp, 8
mov edi, eax
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00413da6
mov esp, ebp
pop ebp
ret
Function at 0x4066d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11b8
call fcn.004142a0
mov eax, dword [0x4262b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11b8], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406718
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x11b0]
mov dword [ebp - 0x11b0], 0
push eax
push 0xfa0
lea eax, [ebp - 0x11ac]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x406708
shr dword [ebp - 0x11b0], 2
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
mov ecx, eax
mov dword [ebp - 0x11b4], ecx
cmp dword [ebp - 0x11b0], esi
jbe 0x4067e6
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x11ac]
cmp ecx, eax
je 0x4067dd
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4067d7
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
push edi
test eax, eax
je 0x4067f9
call ebx
mov ecx, dword [ebp - 0x11b4]
inc esi
cmp esi, dword [ebp - 0x11b0]
jb 0x406770
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
call ebx
mov ecx, dword [ebp - 0x11b8]
mov eax, dword [ebp + esi*4 - 0x11ac]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00413da6
mov esp, ebp
pop ebp
ret
Function at 0x407500
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4169fb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4262b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push str._s
push eax
call fcn.00407e20
add esp, 0xc
lea ecx, [ebp - 0x23c]
call sub.mfc140.dll_Ordinal_503
push 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x23c]
call sub.mfc140.dll_Ordinal_4705
test eax, eax
je 0x40762c
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
nop word [eax + eax]
lea ecx, [ebp - 0x23c]
call sub.mfc140.dll_Ordinal_4725
neg eax
lea ecx, [ebp - 0x23c]
sbb esi, esi
lea eax, [ebp - 0x220]
push eax
inc esi
call sub.mfc140.dll_Ordinal_5562
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
push dword [ebp - 0x21c]
lea eax, [ebp - 0x114]
push str._s_s
push eax
call fcn.00407e20
add esp, 0x10
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x23c]
call sub.mfc140.dll_Ordinal_8140
test eax, eax
jne 0x407624
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x23c]
push 0x10
call dword [eax + 0x40]
test eax, eax
lea eax, [ebp - 0x114]
push eax
je 0x40761f
call fcn.00407500
lea eax, [ebp - 0x114]
push eax
call ebx
add esp, 8
jmp 0x407624
call edi
add esp, 4
test esi, esi
je 0x407590
lea ecx, [ebp - 0x23c]
call sub.mfc140.dll_Ordinal_1142
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret

Function at 0x4090c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416d19
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4262b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::constructor_void_]
push 0
mov dword [ebp - 4], 0
call fcn.0040bb90
add esp, 4
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x40]
push eax
lea eax, [ebp - 0x10]
push str.__08d_01
push eax
call dword [sym.imp.FSUTIL.dll_public:_class_AString____cdecl_AString::Format_char_const__]
add esp, 0xc
lea ecx, [ebp - 0x10]
call dword [sym.imp.FSUTIL.dll_public:_char_const____thiscall_AString::operator_char_const__void_const]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x408830
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b420
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4262b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 1
add eax, esi
je 0x40b4d8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
push eax
push esi
mov byte [eax], 0
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsdec]
add esp, 8
lea eax, [ebp - 0x110]
push eax
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40b4d2
push 0x105
lea eax, [ebp - 0x10c]
xor edi, edi
push eax
push edi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push dword [ebp - 0x110]
test eax, eax
mov eax, 1
cmove edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40b4d2
push esi
push 0x80000000
call ebx
push 0x5c
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr]
add esp, 8
test eax, eax
jne 0x40b460
mov edi, 1
pop ebx
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
call fcn.00413da6
mov esp, ebp
pop ebp
ret 4

Function at 0x40b500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
push esi
jne 0x40b533
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
neg eax
pop esi
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b583
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40b583
test esi, esi
jne 0x40b583
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40bae0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
mov edi, dword [ebx]
add edi, 0xf
and edi, 0xfffffff8
push edi
call sub.mfc140.dll_Ordinal_265
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
push dword [ebx]
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push edi
push ebx
push esi
push 0
push 1
push 0
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10