joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4010a0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x408460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 1
push str.ServicesActive
push 0
mov byte [ebp - 0x21], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40111d
push esi
push edi
xor edi, edi
mov edi, edi
cmp edi, 0x18
jae 0x401114
mov eax, dword [edi + 0x40801c]
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40110b
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401104
cmp dword [ebp - 0x1c], 4
jne 0x401104
mov byte [ebp - 0x21], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 4
cmp byte [ebp - 0x21], 0
je 0x4010d0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
xor ecx, ebp
pop ebx
call fcn.0040423b
mov esp, ebp
pop ebp
ret

Function at 0x401330
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x408460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, 0x10624dd3
mul ecx
push ebx
push esi
mov esi, edx
shr esi, 6
mov edx, esi
imul edx, edx, 0x3e8
sub ecx, edx
push edi
mov dword [ebp - 0x28], esi
je 0x401368
inc esi
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x23], 0
mov dword [ebp - 0x2c], 0
jmp 0x401380
cmp byte [ebp - 0x23], 0
jne 0x401439
cmp dword [ebp - 0x2c], esi
jae 0x401439
push 1
push str.ServicesActive
push 0
mov byte [ebp - 0x22], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40140a
xor edi, edi
mov edi, edi
cmp edi, 0x18
jae 0x4013f4
mov eax, dword [edi + 0x40801c]
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4013eb
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4013e4
cmp dword [ebp - 0x1c], 4
jne 0x4013e4
mov byte [ebp - 0x22], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 4
cmp byte [ebp - 0x22], 0
je 0x4013b0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [ebp - 0x22], 0
mov esi, dword [ebp - 0x28]
je 0x40140a
mov byte [ebp - 0x23], 1
jmp 0x40142c
mov edx, dword [ebp - 0x30]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401428
cmp eax, 0x102
setne byte [ebp - 0x21]
jmp 0x40142c
mov byte [ebp - 0x21], 1
inc dword [ebp - 0x2c]
cmp byte [ebp - 0x21], 0
je 0x401380
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040423b
mov esp, ebp
pop ebp
ret
Function at 0x401780
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x408460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
cmp byte [ebp - 0x10], 1
jne 0x401997
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x4084ac], eax
sete al
test al, al
jne 0x401997
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_strstr]
push 0x4053cc
push esi
call ebx
add esp, 8
test eax, eax
je 0x40180a
mov ecx, dword [0x4084ac]
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401996
cmp eax, 0x102
jne 0x401996
lea edx, [ebp - 0x14]
push edx
call fcn.00401250
add esp, 4
mov dword [0x4084a8], eax
test eax, eax
je 0x401996
mov eax, dword [str.Acrobat_Viewer]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40196e
push 0x401130
push 0x1f4
push eax
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40196e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4084ac], eax
test eax, eax
je 0x401965
push 0x408490
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4053cc
push esi
mov byte [0x4084b4], 0
call ebx
add esp, 8
neg eax
lea ecx, [ebp - 0x20]
push ecx
push 0
sbb eax, eax
inc eax
push eax
push 0x401450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4084b0], eax
test eax, eax
je 0x401944
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
call esi
test eax, eax
je 0x401904
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x401901
lea eax, [ebp - 0x3c]
push eax
call edi
lea ecx, [ebp - 0x3c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
call esi
test eax, eax
jne 0x4018e0
mov edi, dword [ebp - 0x1c]
call fcn.00401170
mov eax, dword [0x4084b0]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40192d
mov ecx, dword [0x4084b0]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x4084b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4084b0], 0
mov eax, dword [0x4084ac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x408490
mov dword [0x4084ac], 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push edi
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x4084a8]
test eax, eax
je 0x40197e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp word [ebp - 0x14], 0
je 0x401996
mov ecx, dword [ebp - 0x18]
mov edx, dword [str.AdobeReaderSpeedLaunchCmdWnd]
push ecx
push edx
call dword [sym.imp.USER32.dll_UnregisterClassA]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040423b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401a70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x401a94
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov dword [esi], ecx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 4], 0
jg 0x401d9e
jl 0x401d82
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0x7fffffff
ja 0x401d9e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 4], 0xffffffff
jg 0x401da3
jl 0x401d9e
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0x80000001
jae 0x401da3
jmp 0x401e35
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x401e35
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xc]
jae 0x401e35
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp + 0x14]
push edx
call fcn.00401c50
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401e28
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jae 0x401e2a
jmp 0x401e35
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x401dd8
mov esp, ebp
pop ebp
ret
Function at 0x402030
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
cmp byte [esi + 0x1d], 0
jne 0x402070
cmp dword [esi + 0x20], 0xffffffff
jne 0x402070
cmp dword [esi + 0x14], 0x10
jb 0x40204e
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
sete al
mov byte [esi + 0x1d], al
mov esi, dword [esi + 0x20]
cmp esi, 0xffffffff
je 0x40212f
cmp byte [ebx], 0
jne 0x40212f
cmp dword [ebx + 4], 0
jne 0x4020b5
cmp byte [ebp + 0xc], 0
mov eax, 2
je 0x40209b
mov eax, 0x1000002
push 0
push 0
push 0
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4020b5
mov byte [ebx], 1
mov eax, dword [ebx + 4]
test eax, eax
je 0x40212f
cmp dword [ebx + 8], 0
jne 0x40212f
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 8], eax
test eax, eax
jne 0x4020e4
cmp eax, eax
pop esi
mov byte [ebx], 1
setne al
pop ebx
pop ebp
ret
push edi
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call fcn.00401aa0
add esp, 8
pop edi
test al, al
je 0x40211b
mov eax, dword [ebp + 8]
test eax, eax
je 0x40211b
mov edx, dword [ebx + 8]
lea eax, [edx + eax - 1]
mov dword [ebx + 0xc], eax
xor eax, eax
cmp edx, eax
pop esi
setne al
pop ebx
pop ebp
ret
mov ecx, dword [ebx + 8]
push ecx
mov byte [ebx], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 8], 0
xor eax, eax
cmp dword [ebx + 8], eax
pop esi
setne al
pop ebx
pop ebp
ret
Function at 0x403a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x403b63
mov dword [ebp + 0x28], edi
test eax, eax
je 0x403b30
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x403b1a
mov edi, eax
add ecx, 0x10
dec edx
jne 0x403b12
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x403b33
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404230
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x403b59
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x24], edi
push 0
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404230
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x403baf
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.0040438d
jmp 0x403bb1
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x403be0
test eax, eax
je 0x403bdd
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.0040432a
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.004036d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x403c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x408460]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
push ecx
push 0
mov byte [ebp - 0x13d], 0
mov dword [ebp - 0x144], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x403d00
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x13c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x403cc7
push ebx
lea ecx, [ebp - 0x13c]
push ecx
push 1
push esi
call edi
add esp, 0x10
mov byte [ebp - 0x13d], 1
lea edx, [ebp - 0x148]
push edx
mov dword [ebp - 0x148], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x403cf7
mov eax, dword [ebp - 0x148]
mov edx, dword [ebp - 0x144]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
cmp byte [ebp - 0x13d], 0
jne 0x403d0b
push ebx
push 0
push 1
push esi
call edi
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040423b
mov esp, ebp
pop ebp
ret

Function at 0x403ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x408460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x144]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403f6e
mov ecx, dword [ebp - 0x144]
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0
push ecx
mov dword [ebp - 0x148], 0x136
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x403f41
mov byte [ebp - 0x13d], 0
jmp 0x403f58
push ebx
lea edx, [ebp - 0x13c]
push edx
push 0
push esi
mov byte [ebp - 0x13d], 1
call edi
add esp, 0x10
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x13d], 0
jne 0x403f79
push ebx
push 0
push 0
push esi
call edi
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040423b
mov esp, ebp
pop ebp
ret

Function at 0x40423b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408460]
jne 0x404245
repz ret
jmp fcn.004046da
Function at 0x51d3da
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x51d400
jmp 0x51d516
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x51d420
jmp 0x51d516
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0052194d
add esp, 4
mov dword [0x52a098], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x51d46d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x51d48d
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x51d46a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x51d4f5
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.005214f0
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x51d4a9
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51d77c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x51d855
mov dword [ebp - 0x14], 0
jmp 0x51d7e0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1e
jge 0x51d855
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x52a09c], ecx
jne 0x51d853
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx*4 + 0x52a1aa]
cmp dword [eax*4 + 0x52a132], ecx
jb 0x51d842
mov eax, dword [ebp - 0xc]
cmp dword [0x52a098], eax
je 0x51d830
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 0x52a114]
push eax
call fcn.0052194d
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x52a098], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.005214a4
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add dword [ecx*4 + 0x52a132], eax
jmp 0x51d855
jmp 0x51d7dd
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x10]
leave
ret 0x14

Function at 0x51d866
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
jmp 0x51d8ae
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1e
jge 0x51d903
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp dword [eax*4 + 0x52a09c], ecx
jne 0x51d901
mov eax, dword [ebp - 8]
cmp dword [0x52a098], eax
je 0x51d8e8
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 0x52a114]
push eax
call fcn.0052194d
add esp, 4
mov eax, dword [ebp - 8]
mov dword [0x52a098], eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.005214f0
add esp, 8
mov dword [ebp - 0xc], 1
jmp 0x51d903
jmp 0x51d8ab
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x51d931
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.005214a4
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x10]
leave
ret 0x14