joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f8a7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x100258ed
call fcn.100244ee
mov esi, ecx
mov eax, dword [0x100450a0]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 1
call fcn.1003f5f6
cmp dword [esi], 1
jne 0x1003f8f2
mov edi, dword [esi + 0x24]
cmp edi, dword [esi + 0x64]
ja 0x1003f8ea
mov edi, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
add eax, dword [esi + 0x20]
jmp 0x1003f903
mov edi, dword [esi + 0x34]
cmp edi, dword [esi + 0x74]
ja 0x1003f8fd
mov edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x2c]
push eax
lea ecx, [esi + 0x84]
call fcn.1003fb08
test eax, eax
je 0x1003fa08
inc edi
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp - 0x38]
call fcn.1001eae3
lea ecx, [edi + edi]
mov dword [ebp - 4], 1
mov edx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edx
mov edi, ebx
mov dword [ebp - 0x24], ebx
cmp edi, 2
jge 0x1003fa2a
mov eax, edi
shl eax, 6
cmp dword [esi], 1
mov dword [ebp - 0x28], eax
jne 0x1003f958
mov ebx, dword [eax + esi + 0x20]
jmp 0x1003f95c
mov ebx, dword [eax + esi + 0x2c]
mov dword [ebp - 0x18], ebx
xor ebx, ebx
cmp ebx, dword [ebp - 0x18]
jae 0x1003fa21
cmp dword [esi], 1
mov eax, dword [eax + esi + 8]
jne 0x1003f988
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegEnumKeyExW]
jmp 0x1003f99e
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegEnumValueW]
test eax, eax
je 0x1003f9a9
mov edi, 0xc0000001
jmp 0x1003fa0d
mov ecx, dword [ebp - 0x20]
push ecx
mov byte [ebp - 4], 4
call fcn.1001f0c3
push eax
lea ecx, [ebp - 0x30]
call fcn.1001ec60
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1003f4c8
test eax, eax
jne 0x1003f9f3
mov eax, edi
mov ecx, esi
shl eax, 6
push ebx
push dword [eax + esi + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.1003f3b5
mov edi, eax
test edi, edi
js 0x1003fa0d
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
inc ebx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
jmp 0x1003f961
mov edi, 0xc0000017
lea ecx, [ebp - 0x30]
call fcn.1001ef70
lea ecx, [ebp - 0x38]
call fcn.1001ef70
mov eax, edi
jmp 0x1003fa59
inc edi
mov dword [ebp - 0x24], edi
jmp 0x1003f93c
lea ecx, [ebp - 0x30]
call fcn.1001ef70
lea ecx, [ebp - 0x38]
call fcn.1001ef70
xor eax, eax
jmp 0x1003fa59
call fcn.10024453
ret
Function at 0x10041ad1
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x100450f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x834]
push esi
push eax
xor esi, esi
mov dword [ebp - 0x838], ebx
push ecx
mov dword [ebp - 0x834], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x834], esi
je 0x10041c9b
push dword [ebp - 0x834]
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x83c], eax
test eax, eax
je 0x10041c9b
push edi
push ecx
mov edx, ebx
mov ecx, eax
call fcn.10041cc4
test eax, eax
je 0x10041c77
xor eax, eax
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82c]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10041c77
mov eax, dword [0x1000cd90]
lea edi, [ebp - 0x82c]
movzx ecx, word [ebp - 0x82c]
mov ebx, esi
mov dword [ebp - 0xc], eax
mov ax, word [0x1000cd94]
mov word [ebp - 8], ax
mov dword [ebp - 0x830], edi
push 0x104
lea eax, [ebp - 0x41c]
mov word [ebp - 0xc], cx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10041c52
lea edi, [ebp - 0x41c]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x10041bbb
sub edi, ecx
sar edi, 1
cmp edi, 0x104
jae 0x10041c4c
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x838]
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
add ebx, 1
je 0x10041c4c
lea eax, [ebp - 0xc]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x214]
call fcn.1000e4a6
mov ecx, dword [ebp - 0x838]
lea eax, [ecx + edi*2]
push eax
lea ecx, [ebp - 0x214]
call fcn.1004181f
mov edi, dword [ebp - 0x838]
lea eax, [ebp - 0x214]
push 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x10041c4c
lea eax, [ebp - 0x214]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.1000e4a6
mov edi, dword [ebp - 0x830]
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x10041c52
mov dword [ebp - 0x830], edi
test ebx, ebx
jne 0x10041c8c
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x10041b90
jmp 0x10041c8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10041c8c
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x10041cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10041cb0
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10023280
mov esp, ebp
pop ebp
ret 8

Function at 0x40ed7f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x40eae0
inc edi
call fcn.0040edba
sub esp, 4
mov dword [esp], 0x58be63ba
mov esi, dword [esp]
add esp, 4
add edi, esi
xor dword [ebx], ecx
dec esi
add ebx, 1
sub esi, edi
and edi, edi
cmp ebx, eax
jne fcn.0040ed7f
or edi, esi
sub edi, 0x6ee9b273
ret
Function at 0x745e07
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x757f29
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x8e2370]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, esi
call fcn.0040cc21
mov edi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.0040d3db
and dword [esp + 0x30], 0
mov ecx, edi
call 0x4babb4
movzx eax, al
push eax
lea ecx, [esp + 0x18]
call fcn.00431f13
or edi, 0xffffffff
push edi
push 0x8c08f8
mov byte [esp + 0x38], 1
call fcn.00413fd4
pop ecx
pop ecx
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x38], 2
call fcn.004083c7
mov ecx, eax
call fcn.00401b63
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00405a22
pop ecx
pop ecx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x745ebe
push dword [esp + 0xc]
call fcn.00410faa
pop ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00431234
push esi
call fcn.00745b8e
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x10]
lock xadd dword [eax], edi
jne 0x745eea
push dword [esp + 0x10]
call fcn.00410faa
pop ecx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4017f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d1cd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4120a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp + 8]
call fcn.004031e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x40186a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403080
mov eax, dword [ebp - 0x34]
jmp 0x401948
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4018a3
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403080
mov eax, dword [ebp - 0x38]
jmp 0x401948
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x18]
mov dword [ecx + 4], eax
push 4
push 0x1000
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 0x24]
mov dword [ecx], eax
push 0
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x24]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp + 0x24]
cmp dword [edx], 0
jne 0x40191f
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403080
mov eax, dword [ebp - 0x3c]
jmp 0x401948
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403080
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x401e90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x401ecc
xor eax, eax
jmp 0x401f55
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401efe
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401f55
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x401f21
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x240], edx
jmp 0x401f42
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401efe
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040556e
mov esp, ebp
pop ebp
ret

Function at 0x401f70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00405110
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.msfte.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401fde
xor eax, eax
jmp 0x40209b
push str.SearchSystemHost.exe
call fcn.00401e90
add esp, 4
test eax, eax
jne 0x402007
push str.SearchUserHost.exe
call fcn.00401e90
add esp, 4
test eax, eax
jne 0x402007
xor eax, eax
jmp 0x40209b
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00405110
add esp, 0xc
push str.APPDATA
call fcn.00406ffd
add esp, 4
push eax
push str._sMicrosoftUserSettingIdentities_version.ini
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x428], 0
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.004048f0
add esp, 8
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00406f57
add esp, 4
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
cmp edx, dword [section..data]
jae 0x402096
xor eax, eax
jmp 0x40209b
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040556e
mov esp, ebp
pop ebp
ret
Function at 0x4029b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 8], eax
push 3
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0
jmp 0x4029f5
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x28]
jge 0x4029ff
jmp 0x4029ec
push 0x40e498
lea ecx, [ebp - 0x24]
call fcn.00402f70
push 0x40e49c
lea ecx, [ebp - 0x44]
call fcn.00402f70
mov eax, dword [ebp + 0x10]
push eax
call fcn.00407077
add esp, 4
test eax, eax
je 0x402a87
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x44]
call fcn.004030e0
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x24]
call fcn.004030e0
push 0x40e4a0
lea ecx, [ebp - 0x64]
call fcn.00402f70
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x44]
call fcn.00404060
shl eax, 1
push eax
lea ecx, [ebp - 0x44]
call fcn.004031e0
push eax
call fcn.00404a40
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.004031e0
push eax
lea ecx, [ebp - 0x44]
call fcn.004030e0
lea ecx, [ebp - 0x64]
call fcn.00403080
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x68], esp
lea edx, [ebp - 0x44]
push edx
call fcn.00402e70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x24]
push eax
call fcn.00402e70
call fcn.00402300
add esp, 0x38
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x44]
call fcn.00403080
lea ecx, [ebp - 0x24]
call fcn.00403080
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040556e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4048f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x404929
xor eax, eax
jmp 0x4049b6
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
push 4
push 0x1000
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 0x64
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 0x64
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00405110
add esp, 0xc
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4049a9
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4049b6
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4049c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4049f6
xor eax, eax
jmp 0x404a2f
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404a20
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x404a2f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40556e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4120a0]
jne 0x405578
repz ret
jmp fcn.00408e2c
Function at 0x40cc7d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004088d0
and dword [ebp - 0x14], 0
cmp dword [0x4139ec], 0
mov dword [ebp - 0x18], eax
jne 0x40cd30
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40cdd8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40cdd8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4139ec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4139f0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4139f4], eax
call edi
push eax
call esi
mov dword [0x4139fc], eax
test eax, eax
je 0x40cd30
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4139f8], eax
mov eax, dword [0x4139f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cd89
cmp dword [0x4139fc], ecx
je 0x40cd89
push eax
call esi
push dword [0x4139fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cd89
test ebx, ebx
je 0x40cd89
call edi
test eax, eax
je 0x40cd80
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cd80
test byte [ebp - 8], 1
jne 0x40cd89
or dword [ebp + 0x10], 0x200000
jmp 0x40cdbc
mov eax, dword [0x4139f0]
cmp eax, dword [ebp - 0x18]
je 0x40cdbc
push eax
call esi
test eax, eax
je 0x40cdbc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cdbc
mov eax, dword [0x4139f4]
cmp eax, dword [ebp - 0x18]
je 0x40cdbc
push eax
call esi
test eax, eax
je 0x40cdbc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4139ec]
call esi
test eax, eax
je 0x40cdd8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cdda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040556e
leave
ret

Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
mov ebx, dword [esp]
add esp, 4
dec esi
mov ecx, esi
call fcn.0043b692
inc esi
sub esi, 1
mov ecx, esi
xor dword [edx], ebx
and ecx, esi
add edx, 1
or ecx, esi
add esi, 0x5eb35864
sub esi, 0x776456c4
cmp edx, edi
jne fcn.0043b646
and esi, esi
sub esi, 0x69a8c857
ret
Function at 0x851370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x85138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x87a074
push ecx
mov edi, eax
call fcn.00865198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8513cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0086502e
push esi
call fcn.00864fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x854850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8548ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x87f720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8548ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.008651e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8548ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x87f720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x85492a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00866082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x854957
mov word [eax], si
add eax, 2
push eax
call fcn.00866030
add esp, 4
jmp 0x854959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8548ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8548b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x854ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x855080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x8550c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x87a458
push ecx
call fcn.008651e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.008651e1
add esp, 0x10
jmp 0x8550d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0086520b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00864dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00855050
mov eax, dword [0x87f728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x85513b
push esi
call fcn.00854fb0
add esp, 4
mov dword [0x87f728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x85514c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00854ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x858440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x8584b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x85848e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x858471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x85847e
add edx, ecx
cmp ebx, edx
jb 0x85848a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x858467
xor ecx, ecx
jmp 0x8584a2
test eax, eax
jne 0x858492
xor ecx, ecx
jmp 0x8584a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.008583c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret