joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41320d
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x40a3b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push eax
push str.create_tool_help_snapshot_failed__err___d
push 0x1d9
push 0x4158e8
call fcn.00405110
add esp, 0x10
jmp 0x40a475
mov dword [ebp - 0x258], 0x22c
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40a40e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
push eax
push str.process32First_failed__err___d
push 0x1e6
push str.utility::process::enumProcess
call fcn.00405110
add esp, 0x10
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a475
lea ecx, [ebp - 0x2c]
call fcn.0040a490
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004026b0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040a690
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040a4b0
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40a40e
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411822
mov esp, ebp
pop ebp
ret

Function at 0x40b090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x40b0cd
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x40b250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x40b0df
mov dword [ebp - 8], 1
jmp 0x40b0e6
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x40b790
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40b7a7
mov dword [ebp - 8], 1
jmp 0x40b7ae
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
call fcn.004026a0
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b7ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b7ef
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x40b7ef
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40b7f2
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40bf00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x40bf2c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x40c012
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x40bfc3
jg 0x40bf55
cmp dword [ebp + 0xc], 0
jbe 0x40bfc3
cmp dword [ebp - 8], 0
jl 0x40bfc3
jg 0x40bf63
cmp dword [ebp - 0xc], 0
jbe 0x40bfc3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x40bf81
jl 0x40bf75
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x40bf81
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00409f20
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x40c006
jg 0x40bfd1
cmp dword [ebp + 0xc], 0
jbe 0x40c006
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x40c006
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x40c040
jl 0x40c037
cmp dword [ebp + 0xc], 0
ja 0x40c040
xor eax, eax
xor edx, edx
jmp 0x40c176
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x40c063
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x40c176
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40c0d0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 4]
call fcn.00402c40
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00409f20
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x4c], 0
je 0x40c167
mov ecx, dword [ebp - 8]
call fcn.0040ca00
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x40c13f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
push 0xfff
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0xfff
je 0x40c13d
xor ecx, ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, ecx
jmp 0x40c176
jmp 0x40c0ec
cmp dword [ebp - 4], 0
jbe 0x40c167
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ca90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x40cab7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40cabe
mov al, 1
jmp 0x40cb9b
call fcn.00409b10
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00409b10
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040d2b0
add esp, 8
movzx eax, al
test eax, eax
je 0x40cafa
xor al, al
jmp 0x40cb9b
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40cb37
cmp dword [ebp - 0x30], 1
je 0x40cb3e
cmp dword [ebp - 0x30], 3
je 0x40cb8e
jmp 0x40cb99
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x40cb6e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x40cb6e
xor al, al
jmp 0x40cb9b
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40cb82
mov dword [ebp - 0x38], 1
jmp 0x40cb89
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x40cb9b
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x40cb9b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411822
mov esp, ebp
pop ebp
ret
Function at 0x40ed80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4136ed
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x41c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00405c60
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040f3c0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040f440
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040f2e0
mov dword [ebp - 0x20], 0x40f480
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.00407ae0
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x40ee20
lea ecx, [ebp - 0x14]
call fcn.0040f2b0
jmp 0x40ee32
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
push 6
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040f2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa205
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, section..data
call eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x2580434e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2580435d
pop dword [ebp - 0x44]
mov eax, 0x2580435d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x7592710c
sub dword [ebp - 0x54], 0x27402bc1
mov dword [ebp - 0x50], 0xe580e4d9
add dword [ebp - 0x50], 0x4cb2676c
mov dword [ebp - 0x4c], 0x89a89b71
sub dword [ebp - 0x4c], 0x3d5c5743
mov dword [ebp - 0x48], 0xee87a74e
add dword [ebp - 0x48], 0x117858b2
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4027b41b
add dword [ebp - 0x54], 0x344ab53b
mov dword [ebp - 0x50], 0x204c46f7
sub dword [ebp - 0x50], 0xdedfe582
mov dword [ebp - 0x4c], 0x8d33e473
add dword [ebp - 0x4c], 0xd63b87f9
mov dword [ebp - 0x48], 0x1add2f5b
add dword [ebp - 0x48], 0xe522d0a5
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xee587e27
add eax, 0x37295259
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac84
push 0
call eax
mov ecx, 0x4b050c0a
add ecx, 0xb4fb34b4
mov esi, eax
mov edi, 0x25829600
add edi, dword [ebp - 0x44]
mov ebx, 0xe47cfaca
sub ebx, 0x4c873e2a
xor dword [ebp - 0x38], 0x4d538ee6
mov edx, dword [edi]
sub dword [ebp - 0x38], edi
add edx, ebx
xor dword [ebp - 0x14], 0x7638c8f2
mov dword [esi], edx
add dword [ebp - 0xc], 0x4f4e5b53
add esi, 4
add edi, 0xed9e921f
add edi, 0x12616de5
loop 0x2580446f
add eax, 0x472fc019
sub eax, 0x472eca4e
xor ebx, ebx
add ebx, eax
add eax, 0x78af6a31
sub eax, 0x78af6a2c
mov ecx, 0x25800000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100194d5
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea0
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x100194fb
mov eax, 0x80070057
jmp 0x1001970d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
xor ebx, ebx
push str.SoftwareMicrosoftOffice_i.0Registration
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp - 0xe9c], ebx
call fcn.1002e4dd
add esp, 0x10
test eax, eax
je 0x100196fd
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100196fd
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [ebp - 0xe9c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x103
je 0x100196fd
test edi, edi
jne 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x484]
mov edi, 0x100
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1002e4dd
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1002e4dd
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1002e4dd
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe98], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x284]
mov dword [ebp - 0xe94], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019655
lea eax, [ebp - 0xea0]
mov dword [ebp - 0xea0], 0x802
push eax
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0xe98]
push eax
push ebx
push 0x1003b278
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0xe94], ebx
je 0x10019669
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100196ce
cmp dword [ebp - 0xe98], 1
je 0x1001967f
cmp dword [ebp - 0xe98], 2
jne 0x100196ce
cmp dword [ebp - 0xe98], 2
jne 0x100196d2
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100196d2
push 0xffffffffffffffff
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push 0x401
push eax
call fcn.1002e4dd
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x1001970a
lea eax, [ebp - 0xe90]
push str._no_more_entries_
push eax
call fcn.1002e4dd
pop ecx
pop ecx
test eax, eax
je 0x1001970a
xor eax, eax
cmp ax, word [ebp - 0xe90]
je 0x1001970a
lea eax, [ebp - 0xe90]
push eax
jmp 0x10019702
push str._no_more_entries_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c65c
leave
ret 0x10
Function at 0x1002e4dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1002e4ec
pop dword [ebp - 0x18]
mov eax, 0x1002e4ec
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x43189
push 0
mov eax, 0x93d69805
add eax, 0x7c2c8953
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xe1f96225
add ecx, 0x1e06ece1
mov edx, eax
mov ebx, 0x10048000
add ebx, dword [ebp - 0x18]
mov esi, 0x1369eee7
xor dword [ebp - 0x10], 0xc34ad24f
mov edi, dword [ebx]
xor edi, esi
add dword [ebp - 4], edi
mov dword [edx], edi
mov dword [ebp - 4], 0xe176093f
add edx, 0xed9f4ad4
sub edx, 0xed9f4ad0
add ebx, 0xa2898285
sub ebx, 0xa2898281
loop 0x1002e53a
add eax, 0x3d100d85
sub eax, 0x3d0ede9a
mov ebx, eax
add eax, 0xd14b0893
add eax, 0x2eb4f772
mov ecx, 0x1daf586e
sub ecx, 0xdaf586e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x416e90
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d55
mov dword [ebp - 0x14], eax
cmp dword [0x826400], esi
jne 0x416f83
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x416f10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x417063
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x417063
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417063
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x826400], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x826404], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x826408], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x826410], eax
test eax, eax
je 0x416f80
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x82640c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416fa8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416f9b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416fbd
push 4
pop eax
jmp 0x417065
cmp dword [ebp - 0x14], esi
je 0x416fbd
push dword [0x826400]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416fa2
mov eax, dword [0x82640c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41701b
cmp dword [0x826410], edi
je 0x41701b
push eax
call ebx
push dword [0x826410]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41701b
test eax, eax
je 0x41701b
call ecx
test eax, eax
je 0x417010
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417010
test byte [ebp - 8], 1
jne 0x41701b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41704b
mov eax, dword [0x826404]
cmp eax, edi
je 0x417048
push eax
call ebx
test eax, eax
je 0x417048
call eax
mov esi, eax
test esi, esi
je 0x417048
mov eax, dword [0x826408]
cmp eax, edi
je 0x417048
push eax
call ebx
test eax, eax
je 0x417048
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x826400]
call ebx
test eax, eax
je 0x417063
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x417065
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f80
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6d57015a
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data_1
nop
mov ebx, 0x4304d8
mov ecx, 0x109f60ff
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx