joyce8/EMBER2024-capa huggingface dataset:
Function at 0x702744
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebp - 0xc], eax
js 0x90cea3
jmp 0x6b2275
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
test ebp, 0x39cd6e98
cmc
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x665ee2
jne 0x90dcf9
mov edx, dword [eax + ecx + 0x78]
test cl, 0xf3
stc
mov dword [ebp - 4], edx
test edx, edx
je 0x90dcf9
mov eax, dword [eax + ecx + 0x7c]
jmp 0x5f0a39
ja 0x92f832
mov eax, esi
cmp esi, 0x650531bb
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x9332fc
push ebp
mov ebp, esp
bsr ecx, ecx
btc ecx, esi
mov ecx, dword [ebp + 8]
cmp esp, 0x735251f7
lea esp, [esp - 0x114]
cmp sp, bp
cmp dh, 0x3d
push esi
test dl, al
test dx, 0x66c3
test ecx, ecx
jmp 0x8a5298
je 0x90dcf9
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x90dce0
ret
je 0x90cea3
mov eax, dword [edx + ecx + 0x20]
cmp si, 0x49c6
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x5d7c5c
je 0x90dcf9
mov eax, 0x5a4d
test cx, 0x863
cmp word [ecx], ax
je 0x937ab7
xor eax, eax
mov si, 0x4b62
mov si, cx
cmova esi, edi
pop esi
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x8b193b
mov edi, dword [edx + ecx + 0x18]
cmp edi, 0x16f063bd
test edi, edi
jmp 0x8e6ef4
jmp 0x90cea3
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x5f6bed

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x402143
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
lea edx, [eax - 1]
mov ebx, eax
and edx, dword [0x403050]
mov eax, 0x403054
call fcn.0040207c
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402e02
push edx
sub edi, fcn.004025ac
push edi
xor eax, eax
push fcn.004025ac
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x4021ae
mov eax, fcn.004025ac
mov ebx, esi
mov edx, edi
call fcn.0040207c
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.00402467
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x402326
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x5e4, 0
sub ebp, 0x8e
lea ebx, [ebp - 0x42]
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x42], ax
call dword [sym.imp.SHLWAPI.DLL_PathAddExtensionW]
lea eax, [ebp - 0x556]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x104
lea ebx, [ebp - 0x34e]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push 0x104
lea eax, [ebp - 0x146]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ebx, [ebp - 0x556]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
lea eax, [ebp + 0x3e]
push eax
push eax
mov byte [ebp + 0x3e], 0
call dword [sym.imp.SHLWAPI.DLL_PathAddExtensionA]
xor eax, eax
push ebx
mov word [ebp + 0x7e], ax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp + 0x7e]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 0
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
lea eax, [ebp - 0x146]
push eax
lea ebx, [esi - 3]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
lea esp, [ebp + 0x8e]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x403851
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x40387c
call fcn.00406e0f
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x40389f
push eax
push dword [esi + 4]
call fcn.0040379d
push esi
push eax
mov ecx, 0x43946c
call fcn.00403404
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x41275a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437dac]
jne 0x412764
repz ret
jmp fcn.0041c3fc

Function at 0x42434a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004188f5
and dword [ebp - 4], 0
cmp dword [0x43bd18], 0
mov ebx, eax
jne 0x4243fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4244ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x430860
push edi
call esi
test eax, eax
je 0x4244ac
push eax
call fcn.00418883
mov dword [esp], 0x430850
push edi
mov dword [0x43bd18], eax
call esi
push eax
call fcn.00418883
mov dword [esp], 0x43083c
push edi
mov dword [0x43bd1c], eax
call esi
push eax
call fcn.00418883
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43bd20], eax
call esi
push eax
call fcn.00418883
pop ecx
mov dword [0x43bd28], eax
test eax, eax
je 0x4243fb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418883
pop ecx
mov dword [0x43bd24], eax
mov eax, dword [0x43bd24]
cmp eax, ebx
je 0x424453
cmp dword [0x43bd28], ebx
je 0x424453
push eax
call fcn.004188fe
push dword [0x43bd28]
mov esi, eax
call fcn.004188fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424453
test edi, edi
je 0x424453
call esi
test eax, eax
je 0x42444a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42444a
test byte [ebp - 0xc], 1
jne 0x424453
or dword [ebp + 0x10], 0x200000
jmp 0x42448c
mov eax, dword [0x43bd1c]
cmp eax, ebx
je 0x42448c
push eax
call fcn.004188fe
pop ecx
test eax, eax
je 0x42448c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42448c
mov eax, dword [0x43bd20]
cmp eax, ebx
je 0x42448c
push eax
call fcn.004188fe
pop ecx
test eax, eax
je 0x42448c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43bd18]
call fcn.004188fe
pop ecx
test eax, eax
je 0x4244ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4244ae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401040
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x10168
call fcn.00402e60
mov eax, dword [0x4100c4]
xor eax, esp
mov dword [esp + 0x10164], eax
mov eax, dword [esp + 0x10174]
push ebx
push ebp
mov ebp, dword [esp + 0x10174]
push edi
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010a2
pop edi
pop ebp
or eax, eax
pop ebx
mov ecx, dword [esp + 0x10164]
xor ecx, esp
call fcn.00402e48
add esp, 0x10168
ret
push esi
mov esi, dword [esp + 0x10180]
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jle 0x40114d
lea ebx, [ebx]
cmp esi, 0x10000
mov eax, 0x10000
jg 0x4010cf
mov eax, esi
push ebx
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x180]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4011cb
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
jbe 0x40114d
xor eax, eax
cmp ecx, ebx
jbe 0x40110f
jmp 0x401100
add byte [esp + eax + 0x174], 0xc9
add eax, 1
cmp eax, ecx
jb 0x401100
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x180]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4011e8
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x4011e8
sub esi, eax
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jg 0x4010c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
lea edx, [esp + 0x75]
push ebx
push edx
mov byte [esp + 0x7c], bl
call fcn.00402e90
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.00402770
push 0x44
lea ecx, [esp + 0x44]
push ebx
push ecx
call fcn.00402e90
add esp, 0x20
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x78]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x80], 1
mov word [esp + 0x84], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4011d7
mov eax, 0xfffffff9
jmp 0x4011f4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x4011f4
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x4011f4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x10174]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402e48
add esp, 0x10168
ret
Function at 0x401d90
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40c73b
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4100c4]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
mov eax, dword [0x4100c4]
xor eax, esp
push eax
lea eax, [esp + 0x42c]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [esp + 0x43c]
push 0x400
lea eax, [esp + 0x2c]
push eax
push str.Path
call edi
mov eax, esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401e01
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.00401a90
push 1
push 0x40d204
lea ecx, [esp + 0x14]
mov dword [esp + 0x43c], 0
call fcn.004019a0
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401e40
sub eax, edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.004019a0
mov eax, dword [esp + 0x10]
mov esi, 0x10
cmp dword [esp + 0x24], esi
jae 0x401e6d
lea eax, [esp + 0x10]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x400
lea edx, [esp + 0x2c]
push edx
push str.Path
call edi
cmp dword [esp + 0x24], esi
jb 0x401e9d
mov eax, dword [esp + 0x10]
push eax
call fcn.00402c18
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x42c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00402e48
add esp, 0x42c
ret
Function at 0x4027a0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4027c7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4027c7
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4027d0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40280d
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4028a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x118
mov eax, dword [0x4100c4]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40294f
push edi
push 0x103
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.00402e90
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call fcn.004039f4
push eax
call fcn.00403a30
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 8
nop
call fcn.00403a3d
movzx ecx, word [esp + 0x14]
movzx edx, word [esp + 0x12]
push eax
movzx eax, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x18]
push ecx
movzx ecx, word [esp + 0x1a]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push edx
push str._sT_02d_02d_02d_02d_04d_09d
push esi
call fcn.004034d8
add esp, 0x24
push esi
call edi
test eax, eax
jne 0x402910
pop edi
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00402e48
add esp, 0x118
ret

Function at 0x402970
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4100c4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push eax
push esi
call fcn.00402850
lea ecx, [esp + 0xc]
push 0x40d254
push ecx
call fcn.004039e1
add esp, 0x10
test eax, eax
je 0x4029e3
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4029e3
lea eax, [esp + 4]
push eax
call fcn.00402970
add esp, 4
test eax, eax
jne 0x4029e3
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00402e48
add esp, 0x108
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00402e48
add esp, 0x108
ret

Function at 0x402e48
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4100c4]
jne 0x402e52
repz ret
jmp fcn.0040538d
Function at 0x40af6b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00404e8d
xor ebx, ebx
cmp dword [0x411a5c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b040
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40afab
xor eax, eax
jmp 0x40b104
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40afa4
push eax
call fcn.00404e2a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411a5c], eax
call esi
push eax
call fcn.00404e2a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411a60], eax
call esi
push eax
call fcn.00404e2a
mov dword [0x411a64], eax
lea eax, [ebp - 8]
push eax
call fcn.00407321
test eax, eax
pop ecx
pop ecx
je 0x40b00e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402f14
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b040
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404e2a
cmp eax, ebx
pop ecx
mov dword [0x411a6c], eax
je 0x40b040
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e2a
pop ecx
mov dword [0x411a68], eax
mov eax, dword [0x411a68]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b0b9
cmp dword [0x411a6c], esi
je 0x40b0b9
push eax
call fcn.00404e96
pop ecx
call eax
cmp eax, ebx
je 0x40b086
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x411a6c]
call fcn.00404e96
pop ecx
call eax
test eax, eax
je 0x40b086
test byte [ebp - 0x18], 1
jne 0x40b0b9
lea eax, [ebp - 0xc]
push eax
call fcn.00407358
test eax, eax
pop ecx
je 0x40b0a1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402f14
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b0b0
or dword [ebp + 0x10], 0x200000
jmp 0x40b0ea
or dword [ebp + 0x10], 0x40000
jmp 0x40b0ea
mov eax, dword [0x411a60]
cmp eax, esi
je 0x40b0ea
push eax
call fcn.00404e96
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b0ea
mov eax, dword [0x411a64]
cmp eax, esi
je 0x40b0ea
push dword [ebp - 4]
push eax
call fcn.00404e96
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x411a5c]
call fcn.00404e96
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58de58ce
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x246207a4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x43fcf0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac49b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049ef6c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x43fd72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049c43d
mov eax, dword [eax]
push 0x4c91f4
push eax
call fcn.0048f104
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049f1f7
test bl, bl
je 0x43fd72
push 0x4c91f4
lea ecx, [esp + 0xc]
call fcn.0049f5d3
push 0x4ccd78
lea ecx, [esp + 0xc]
call fcn.0049f5d3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43fdae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049f1f7
jmp 0x43fe79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x43fe32
lea edx, [esp + 0x7c]
push 0x4ccd74
push edx
call fcn.0048f104
add esp, 8
test eax, eax
je 0x43fe32
lea eax, [esp + 0x7c]
push 0x4ccd70
push eax
call fcn.0048f104
add esp, 8
test eax, eax
je 0x43fe32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43fdc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049f1f7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x440670
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4406d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc