joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100209fc
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
cmp byte [0x10036ee8], 0
je 0x10020a21
push str.TabProcGrowth
call fcn.1001d8de
mov dword [esp], str.TabShutdownDelay
call fcn.1001d8de
pop ecx
jmp fcn.10020ba4
ret

Function at 0x10020ba4
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100361bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x11
pop ecx
and dword [ebp - 0x8c], 0
lea edi, [ebp - 0x88]
mov esi, str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x88]
movsb byte es:[edi], byte [esi]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10020c56
and dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push str.SecureProtocols
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10020c56
cmp byte [0x10036ee8], 0
je 0x10020cfe
push str._ACTWinBrowser__DumpTLSReg_GPO_settings_applied
jmp 0x10020ce0
push 0xf
pop ecx
lea eax, [ebp - 0x8c]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push eax
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
push 0x20019
xor esi, esi
lea eax, [ebp - 0x40]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10020d0a
lea eax, [ebp - 0x94]
mov dword [ebp - 0x90], esi
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x98]
push eax
push esi
push str.SecureProtocols
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10020d0a
cmp byte [0x10036ee8], 0
je 0x10020cfe
push str._ACTWinBrowser__IE_Internet_Options_applied
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10020cfe
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0x90]
call fcn.1001d8de
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002652e
mov esp, ebp
pop ebp
ret
Function at 0x10022a53
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x10028ecf
call fcn.100265a9
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xad0], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10022a36
test esi, esi
lea eax, [ebp - 0xac8]
cmovne eax, esi
mov dword [ebp - 0xacc], eax
test edi, edi
je 0x10022be6
cmp dword [edi + 0x400], ebx
jne 0x10022ad1
push ebx
push ebx
push ebx
push ebx
call fcn.1001fc73
add esp, 0x10
test eax, eax
je 0x10022be6
push dword [edi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_swprintf_s]
add esp, 0x18
test eax, eax
jle 0x10022be6
lea ecx, [ebp - 0x6bc]
call fcn.10022a16
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.1001d8de
add esp, 0x18
test eax, eax
jne 0x10022bbc
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10025ba0
push dword [edi + 0x400]
mov esi, dword [ebp - 0xacc]
lea eax, [ebp - 0x6bc]
push 0x1388
push esi
push eax
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 4], ebx
call fcn.10025dd8
test eax, eax
jne 0x10022b7f
cmp dword [esi + 4], ebx
sete bl
jmp 0x10022bab
cmp byte [0x10036ee8], 0
je 0x10022bab
push str.IPC_Error:_AIPC_ERR
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10022bab
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ac]
call fcn.10025c9a
jmp 0x10022be6
cmp byte [0x10036ee8], bl
je 0x10022be6
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
pop ecx
pop ecx
cmp byte [0x10036ee8], bl
je 0x10022be6
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.10026558
ret
Function at 0x10024586
Capabilities:
Print debug messages

Disassembly:
push ebx
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100245a3
push 8
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024692
push esi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x100386f8
push edi
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push edi
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Uns32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_HANDLE____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Handle32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_void____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x10024713
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x10028feb
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 8]
je 0x10024753
lea eax, [esi + 4]
mov edi, 0x100386f8
push eax
push str.ASM_Release__s
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024753
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.1001d8de
push dword [esi + 0x48]
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1000229e
pop ecx
pop ecx
test eax, eax
je 0x1002477e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.1001d8de
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
call fcn.10026558
ret
Function at 0x10024795
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x10029018
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 0x30], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
je 0x100247f9
call fcn.1001d8de
test al, al
mov edx, 0x1002a665
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x100386f8
call edi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x100247f9
push 0x100386f8
call esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
and dword [eax], 0
mov eax, dword [ebp - 0x30]
and dword [eax], 0
lea eax, [ebx + 4]
push eax
call fcn.1001d8de
push dword [ebx + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000229e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.1001d8de
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x10024862
cmp byte [0x10036ee8], cl
je 0x100248ae
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x100386f8
push ebx
call edi
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x100248ae
push ebx
call esi
jmp 0x100248ae
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0x44], eax
test eax, eax
jne 0x1002487d
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002484a
mov ecx, dword [ebp - 0x34]
push dword [ebx + 0x48]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebx + 0x4c], eax
test eax, eax
jne 0x1002489e
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002484a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx + 0x4c]
mov dword [ecx], eax
call fcn.10026558
ret
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x412687
pop dword [ebp - 0x38]
mov eax, 0x412687
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x38762
push 0
mov eax, 0x49f9517a
add eax, 0xb6480f52
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x2b9de37b
add ecx, 0xd4626ae0
mov edx, eax
mov ebx, 0x77165460
sub ebx, 0x76d1ec60
add ebx, dword [ebp - 0x38]
mov edi, 0x21ffedcd
mov dword [ebp - 0x18], 0x4dd592df
mov esi, dword [ebx]
add dword [ebp - 4], 0x59092b40
add esi, edi
xor dword [ebp - 0x28], esi
mov dword [edx], esi
add dword [ebp - 0x10], edx
add edx, 0xb01f31b6
sub edx, 0xb01f31b2
add ebx, 4
loop 0x4126db
add eax, 0xddcca4cd
add eax, 0x22348772
xor ebx, ebx
add ebx, eax
add eax, 0xd8168a34
add eax, 0x27e975d1
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
xor eax, eax
fstp dword [esp + 4]
xor ecx, ecx
fldz
mov word [esp], ax
fstp qword [esp + 8]
mov edx, 1
fld qword [esp + 8]
fsubr qword [0x41f360]
fmul qword [esp + 8]
mov word [esp + 0x52], ax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x24], ecx
fstp qword [esp + 8]
mov dword [esp + 0x28], ecx
fld qword [esp + 8]
mov dword [esp + 0x2c], ecx
fadd qword [esp + 8]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], ecx
fadd qword [esp + 8]
fcomp qword [0x41f358]
fnstsw ax
fld qword [esp + 8]
fadd qword [0x41f350]
fstp qword [esp + 8]
test ah, 0x41
jne 0x40115c
fld dword [esp + 4]
fcomp qword [0x41f348]
fnstsw ax
test ah, 0x41
jne 0x40115c
mov ax, word [0x425318]
fld qword [0x4250c0]
add word [0x425318], dx
fstp st(0)
mov word [esp + 0x50], dx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 8
push ecx
push ecx
push ecx
mov ecx, dword [esp + 0x8c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x64
ret
Function at 0x401280
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x144
mov eax, dword [0x425ff0]
xor eax, esp
mov dword [esp + 0x140], eax
fldz
push ebx
fstp qword [esp + 0x14]
push esi
fldz
push edi
xor edi, edi
fst dword [esp + 0x1c]
push 0x104
mov dword [esp + 0x10], edi
fstp dword [esp + 0x18]
mov dword [esp + 0x14], edi
call fcn.0040b048
add esp, 4
push edi
push 2
mov ebx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
fld qword [0x425eb8]
fsub qword [0x41f380]
mov esi, eax
mov dword [esp + 0x18], esi
fstp qword [0x425eb8]
cmp esi, edi
je 0x40144a
push ebp
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
mov ecx, dword [esp + 0x10]
mov edx, 0xde6085cc
sub edx, ecx
mov ebp, 1
mov word [0x424580], dx
add dword [esp + 0x10], ebp
cmp eax, edi
je 0x401442
mov edi, ebx
lea eax, [esp + 0x4c]
sub edi, eax
lea eax, [esp + 0x4c]
jmp 0x401330
mov cl, byte [eax]
mov byte [edi + eax], cl
add eax, ebp
test cl, cl
jne 0x401330
mov cx, word [0x4258f0]
movsx edx, cx
mov eax, 0xd3eb655b
sub eax, edx
mov dword [esp + 0x10], eax
push ebx
fild dword [esp + 0x14]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call fcn.0041e173
mov ecx, dword [esp + 0x15c]
add esp, 4
mov eax, ebx
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401390
test dl, dl
je 0x40138c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401390
add eax, 2
add ecx, 2
test dl, dl
jne 0x401370
xor eax, eax
jmp 0x401395
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401421
cmp dword [esp + 0x15c], eax
je 0x40143e
mov ecx, dword [esp + 0x30]
push ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40141d
add word [0x4258f0], bp
mov dx, word [0x4258f0]
add dword [esp + 0x14], ebp
movsx eax, dx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fadd dword [esp + 0x20]
call fcn.0040aec0
push 0xffffffffffffffff
mov word [0x4250a8], ax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
fld qword [0x424208]
fsub qword [0x41f378]
fstp qword [0x425910]
fld qword [0x424208]
fadd qword [0x41f350]
fstp qword [0x424208]
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401327
jmp 0x401442
add dword [esp + 0x14], ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
push ebx
call fcn.0040af6b
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b112
add esp, 0x144
ret
Function at 0x4020a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
fldz
push ebx
push esi
fstp dword [esp + 8]
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xc], cx
push edi
call fcn.0040b048
fld qword [0x425a78]
fsub qword [0x41f438]
mov edx, dword [0x425a94]
mov dword [esp + 0x1c], edx
mov esi, eax
fsub qword [0x41f430]
fild dword [esp + 0x1c]
faddp st(1)
call fcn.0040aec0
mov ebx, dword [esp + 0x18]
push edi
push ebx
mov dword [0x425a94], eax
push esi
call fcn.0040b1b0
mov ecx, dword [0x427804]
add ecx, ebx
add edi, esi
add esp, 0x10
sub ecx, 0x423004
mov eax, esi
mov dword [0x425a3c], 0x30f38671
cmp esi, edi
je 0x40212c
nop
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
cmp eax, edi
jne 0x402120
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x402720
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
fldz
push ebx
push esi
fst dword [esp + 8]
push edi
fst dword [esp + 0x10]
push 3
fstp dword [esp + 0x1c]
push 0x425814
call fcn.004020a0
mov ebx, dword [esp + 0x28]
mov edi, eax
push edi
push ebx
call fcn.0040b95f
fld dword [0x425a04]
fsub dword [esp + 0x1c]
mov esi, eax
add esp, 0x10
fadd dword [0x425a9c]
fcomp qword [0x41f4b8]
fnstsw ax
fld1
test ah, 0x44
jnp 0x4027c3
mov ax, word [0x425a08]
movsx ecx, ax
sub ecx, 0x5cba5025
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fld dword [esp + 0x18]
fsub qword [0x41f4b0]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4027c3
fld dword [esp + 0xc]
fadd st(1)
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp st(0)
fld dword [0x425a2c]
fstp st(0)
fld dword [esp + 0xc]
fstp st(0)
fld dword [esp + 0xc]
fadd st(1)
fstp dword [esp + 0xc]
test esi, esi
jne 0x4027fc
fsubr dword [esp + 0xc]
push 0x3e8
fstp dword [esp + 0x10]
fld dword [0x42318c]
fsub dword [esp + 0x10]
fstp dword [0x42318c]
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call fcn.0040b95f
mov esi, eax
add esp, 8
test esi, esi
je 0x402843
jmp 0x4027fe
fstp st(0)
dec dword [0x425904]
mov dx, word [0x4258fc]
mov ecx, dword [0x425904]
movsx eax, dx
sub eax, ecx
add eax, 0x133f43f5
mov dword [esp + 0x18], eax
push esi
push 1
fild dword [esp + 0x20]
lea edx, [esp + 0x2c]
push 4
push edx
fmul dword [esp + 0x20]
fstp dword [esp + 0x20]
call fcn.0040b819
push esi
call fcn.0040b63b
add esp, 0x14
push edi
push 3
call fcn.00401470
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x403720
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
fldz
push ebx
xor eax, eax
mov word [esp + 4], ax
xor ecx, ecx
push 0x2e
mov word [esp + 0xc], cx
fstp dword [esp + 0x18]
push 0x42514c
call fcn.004020a0
mov dx, word [esp + 0xc]
mov ebx, eax
movsx eax, dx
add eax, 0x3bf7b292
mov dword [esp + 0x18], eax
add esp, 8
fild dword [esp + 0x10]
fld dword [esp + 0x14]
mov cx, word [esp + 4]
fsub qword [0x41f5b0]
inc dword [esp + 4]
movsx edx, cx
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fsubp st(1)
fcompp
fnstsw ax
test ah, 5
jp 0x4037ad
mov ax, word [esp + 8]
movsx ecx, ax
sub ecx, 0x32794b2
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fadd qword [0x424208]
fstp qword [0x424208]
dec dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403808
push esi
push edi
push 0x34
push 0x425a44
call fcn.004020a0
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4037e0
sub eax, edi
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push 0x34
call fcn.00401470
add esp, 8
pop edi
pop esi
push ebx
push 0x2e
call fcn.00401470
mov ecx, dword [esp + 0x14]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0x14
ret
Function at 0x40b112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425ff0]
jne 0x40b11c
repz ret
jmp fcn.0040f4e7

Function at 0x416554
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004118d1
and dword [ebp - 4], 0
cmp dword [0x428274], 0
mov ebx, eax
jne 0x416605
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4166b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420bd8
push edi
call esi
test eax, eax
je 0x4166b6
push eax
call fcn.0041185f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428274], eax
call esi
push eax
call fcn.0041185f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428278], eax
call esi
push eax
call fcn.0041185f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42827c], eax
call esi
push eax
call fcn.0041185f
pop ecx
mov dword [0x428284], eax
test eax, eax
je 0x416605
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041185f
pop ecx
mov dword [0x428280], eax
mov eax, dword [0x428280]
cmp eax, ebx
je 0x41665d
cmp dword [0x428284], ebx
je 0x41665d
push eax
call fcn.004118da
push dword [0x428284]
mov esi, eax
call fcn.004118da
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41665d
test edi, edi
je 0x41665d
call esi
test eax, eax
je 0x416654
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416654
test byte [ebp - 0xc], 1
jne 0x41665d
or dword [ebp + 0x10], 0x200000
jmp 0x416696
mov eax, dword [0x428278]
cmp eax, ebx
je 0x416696
push eax
call fcn.004118da
pop ecx
test eax, eax
je 0x416696
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416696
mov eax, dword [0x42827c]
cmp eax, ebx
je 0x416696
push eax
call fcn.004118da
pop ecx
test eax, eax
je 0x416696
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428274]
call fcn.004118da
pop ecx
test eax, eax
je 0x4166b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4166b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003e2a
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003e2a
int3

Function at 0x700de90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700def4
cmp byte [esi + 0x10], 0
je 0x700deb2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700dee2
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700defb
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700def6
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.07003e2a
int3

Function at 0x700e170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700e1c3
cmp dword [esi + 0xc], 0
je 0x700e1be
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700e1b1
push str.stream_write_error
jmp 0x700e1c8
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.07003e2a
int3
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d