joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66caf380
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x66ce1808], 8
jne 0x66caf3b0
mov dword [esp], ebx
call sub.kernel32.dll_SetCurrentDirectoryW
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
mov edx, 0xffffffff
mov eax, ebx
call fcn.66c8e860
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.tr2_sys__Current_set_wchar
mov dword [esp + 4], 0x66ce1808
mov dword [esp], 3
call fcn.66c8edb0
jmp 0x66caf393

Function at 0x66caf3f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x66ce1808], 8
jne 0x66caf440
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.kernel32.dll_CreateDirectoryW
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x66caf436
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
setne al
movzx eax, al
neg eax
mov ebx, dword [ebp - 4]
leave
ret
mov edx, 0xffffffff
mov eax, ebx
call fcn.66c8e860
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.tr2_sys__Make_dir_wchar
mov dword [esp + 4], 0x66ce1808
mov dword [esp], 3
call fcn.66c8edb0
jmp 0x66caf403

Function at 0x66caf480
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x66ce1808], 8
jne 0x66caf4b0
mov dword [esp], ebx
call sub.kernel32.dll_RemoveDirectoryW
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
mov edx, 0xffffffff
mov eax, ebx
call fcn.66c8e860
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.tr2_sys__Remove_dir_wchar
mov dword [esp + 4], 0x66ce1808
mov dword [esp], 3
call fcn.66c8edb0
jmp 0x66caf493

Function at 0x66caf590
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x66ce1808], 8
jne 0x66caf5e0
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.kernel32.dll_MoveFileExW
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
jne 0x66caf5d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xffffffff
mov eax, esi
call fcn.66c8e860
mov edx, 0xffffffff
mov edi, eax
mov eax, ebx
call fcn.66c8e860
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x66cea2a0
mov dword [esp + 8], str.tr2_sys__Rename_wchar
mov dword [esp + 4], 0x66ce1808
mov dword [esp], 3
call fcn.66c8edb0
jmp 0x66caf5a8
Function at 0x66caf7e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x66ce1808], 8
jne 0x66caf840
test esi, esi
je 0x66caf8e0
mov dword [esp], esi
call sub.kernel32.dll_GetFileAttributesW
sub esp, 4
cmp eax, 0xffffffff
je 0x66caf880
test ebx, ebx
je 0x66caf82b
mov edx, eax
and edx, 1
cmp edx, 1
sbb edx, edx
and edx, 0x92
add edx, 0x16d
mov dword [ebx], edx
test al, 0x10
setne al
movzx eax, al
add eax, 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov edx, 0xffffffff
mov eax, esi
call fcn.66c8e860
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x66cea2b5
mov dword [esp + 8], str._Stat
mov dword [esp + 4], 0x66ce1808
mov dword [esp], 3
call fcn.66c8edb0
jmp 0x66caf7f7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 0x7b
je 0x66caf8e0
ja 0x66caf8c8
cmp eax, 3
ja 0x66caf8b0
cmp eax, 2
sbb eax, eax
lea esp, [ebp - 8]
and eax, 9
pop ebx
pop esi
sub eax, 1
pop ebp
ret
cmp eax, 0x35
setne al
lea esp, [ebp - 8]
movzx eax, al
pop ebx
pop esi
lea eax, [eax + eax*8 - 1]
pop ebp
ret
cmp eax, 0xa1
setne al
lea esp, [ebp - 8]
movzx eax, al
pop ebx
pop esi
lea eax, [eax + eax*8 - 1]
pop ebp
ret
mov eax, 0xffffffff
jmp 0x66caf836

Function at 0x66cb1b20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sub.ucrtbase.dll____lc_locale_name_func
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], 2
mov dword [esp + 8], edx
mov dword [esp + 4], 0x22
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call sub.kernel32.dll_GetLocaleInfoEx
sub esp, 0x10
test eax, eax
je 0x66cb1b75
movzx edx, word [ebp - 0xc]
cmp dx, 0x30
je 0x66cb1b80
mov eax, 1
cmp dx, 0x31
je 0x66cb1b75
xor eax, eax
cmp dx, 0x32
sete al
lea eax, [eax + eax*2]
leave
ret
leave
mov eax, 2
ret

Function at 0x66cb1b90
Capabilities:
Get geographical location

Disassembly:
test byte [0x66ce2e74], 8
jne 0x66cb1ba0
jmp sym.msvcp140.dll__Getdateorder
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x66cf0d00
mov dword [esp + 8], str._Locinfo__Getdateorder
mov dword [esp + 4], 0x66ce2e74
mov dword [esp], 3
call fcn.66cb00a0
leave
jmp sym.msvcp140.dll__Getdateorder
Function at 0x66ccc0f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov ecx, eax
sub ecx, dword [ebp + 8]
mov ebx, edx
sub ebx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
test byte [0x66ce2e74], 8
jne 0x66ccc270
test esi, esi
je 0x66ccc2b6
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.kernel32.dll_LocaleNameToLCID
mov esi, eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov edi, eax
or edi, esi
jne 0x66ccc168
cmp dword [ebp - 0x2c], ebx
jae 0x66ccc2c8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 8
mov dword [esp], eax
call sub.kernel32.dll_MultiByteToWideChar
sub esp, 0x18
mov edi, eax
test eax, eax
jne 0x66ccc1b0
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [eax + eax]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
test eax, eax
je 0x66ccc19c
mov dword [ebp - 0x34], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 8
mov dword [esp], eax
call sub.kernel32.dll_MultiByteToWideChar
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
sub esp, 0x18
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x400
mov dword [ebp - 0x2c], edx
call sub.kernel32.dll_LCMapStringW
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub esp, 0x18
mov ebx, eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p__p__p__p__p__n
mov dword [esp + 8], str._Strxfrm
mov dword [esp + 4], 0x66ce2e74
mov dword [esp], 3
call fcn.66cb00a0
test esi, esi
jne 0x66ccc124
lea eax, [ebp - 0x20]
call fcn.66cb0720
jmp 0x66ccc12f
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x66ccf1b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x44
mov eax, dword [0x66ce2ecc]
cmp eax, 0xffffffff
je 0x66ccf1f8
mov edx, dword [ebx]
cmp edx, eax
jge 0x66ccf1d8
add edx, 1
mov dword [ebx], edx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [ebx], 0
mov dword [esp], 0
call sub.kernel32.dll_Sleep
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sub.kernel32.dll_GetSystemInfo
sub esp, 4
cmp dword [ebp - 0x18], 2
sbb eax, eax
not eax
and eax, 0xfa0
mov dword [0x66ce2ecc], eax
jmp 0x66ccf1c3

Function at 0x66cd0500
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test byte [0x66ce3178], 8
jne 0x66cd0588
mov dword [esp], 0x66ce3120
call sub.kernel32.dll_EnterCriticalSection
mov ecx, dword [0x66d13a2c]
sub esp, 4
test ecx, ecx
je 0x66cd05c0
mov eax, dword [0x66d13a28]
mov edx, dword [0x66d13a30]
cmp ecx, eax
je 0x66cd0610
lea ecx, [eax + 1]
shl eax, 4
add eax, edx
mov dword [0x66d13a28], ecx
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x24]
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov dword [eax], edx
mov dword [eax + 0xc], ebx
mov dword [esp], 0x66ce3120
call sub.kernel32.dll_LeaveCriticalSection
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p__p__p__n
mov dword [esp + 8], str._Cnd_register_at_thread_exit
mov dword [esp + 4], 0x66ce3178
mov dword [esp], 3
call fcn.66ccf3a0
jmp 0x66cd051b
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov dword [0x66d13a30], eax
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x66cd056e
mov dword [0x66d13a2c], 8
mov eax, dword [0x66d13a28]
jmp 0x66cd054b
shl eax, 5
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapReAlloc
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x66cd056e
mov dword [0x66d13a30], eax
mov eax, dword [0x66d13a28]
shl dword [0x66d13a2c], 1
jmp 0x66cd054b
Function at 0x66cd0c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test byte [0x66ce3178], 8
jne 0x66cd0cd0
lea eax, [ebx + 4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateThread
sub esp, 0x18
test eax, eax
mov dword [ebx], eax
sete al
lea esp, [ebp - 0xc]
movzx eax, al
pop ebx
pop esi
shl eax, 2
pop edi
pop ebp
ret
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__p__n
mov dword [esp + 8], str._Thrd_start
mov dword [esp + 4], 0x66ce3178
mov dword [esp], 3
call fcn.66ccf3a0
jmp 0x66cd0c8b

Function at 0x66cd0df0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test byte [0x66ce3178], 8
jne 0x66cd0e30
mov eax, dword [0x66ce2ed0]
cmp eax, 0xffffffff
je 0x66cd0e10
leave
ret
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [0x66ce2ed0], eax
leave
ret
mov dword [esp + 0xc], 0x66cf534f
mov dword [esp + 8], str._Thrd_hardware_concurrency
mov dword [esp + 4], 0x66ce3178
mov dword [esp], 3
call fcn.66ccf3a0
jmp 0x66cd0dff

Function at 0x66cd36c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x66d13a34]
test eax, eax
je 0x66cd36db
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtClose]
sub esp, 4
mov edx, dword [0x66d13a30]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
leave
ret
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x412687
pop dword [ebp - 0x1c]
mov eax, 0x97016c8e
sub eax, 0x96c04607
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x382e6
push 0
mov eax, 0xfac1f129
sub eax, 0xfa80905d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4d3c
xor esi, esi
add esi, eax
mov edi, 0x422a7726
sub edi, 0x41e60f26
add edi, dword [ebp - 0x1c]
mov edx, 0x5e4efb95
add edx, 0xcab548cd
sub dword [ebp - 0x10], ecx
mov ebx, dword [edi]
mov dword [ebp - 0xc], 0x45fa6a6c
xor ebx, edx
sub dword [ebp - 0x18], 0x2d57c465
mov dword [esi], ebx
sub dword [ebp - 4], edi
add esi, 4
add edi, 4
loop 0x4126e2
add eax, 0xd39dfa55
add eax, 0x2c632d6e
mov ebx, eax
add eax, 0xe61ae474
add eax, 0x19e51b91
mov ecx, 0x7354b16c
add ecx, 0x8ceb4e94
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40d568
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d1c
mov dword [ebp - 0x14], eax
cmp dword [0x436218], esi
jne 0x40d65b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d73b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d73b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d73b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x436218], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43621c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x436220], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x436228], eax
test eax, eax
je 0x40d658
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x436224], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d680
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d673
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d695
push 4
pop eax
jmp 0x40d73d
cmp dword [ebp - 0x14], esi
je 0x40d695
push dword [0x436218]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d67a
mov eax, dword [0x436224]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d6f3
cmp dword [0x436228], edi
je 0x40d6f3
push eax
call ebx
push dword [0x436228]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d6f3
test eax, eax
je 0x40d6f3
call ecx
test eax, eax
je 0x40d6e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6e8
test byte [ebp - 8], 1
jne 0x40d6f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d723
mov eax, dword [0x43621c]
cmp eax, edi
je 0x40d720
push eax
call ebx
test eax, eax
je 0x40d720
call eax
mov esi, eax
test esi, esi
je 0x40d720
mov eax, dword [0x436220]
cmp eax, edi
je 0x40d720
push eax
call ebx
test eax, eax
je 0x40d720
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x436218]
call ebx
test eax, eax
je 0x40d73b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d73d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040d0
mov esp, ebp
pop ebp
ret
Function at 0x4010a0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x68
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401117
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push str.ScreenSaveUtility
push edx
mov dword [esp + 0x28], eax
call esi
test eax, eax
jne 0x401117
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
call ebp
mov edi, eax
test edi, edi
je 0x401117
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push 0
push str.ScreenSaveUtility
push edx
call esi
test eax, eax
je 0x401120
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68
ret
mov ecx, 0x10
lea eax, [esp + 0x18]
lea esp, [esp]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401130
mov ecx, 0x44
lea eax, [esp + 0x28]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401144
push edi
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 0x81
mov word [esp + 0x5c], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, eax
push eax
push 0x40
call ebp
push edi
mov esi, eax
push str.__s___c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x68
ret

Function at 0x4011c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x402060
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401208
push ebx
push edi
push ebp
lea edi, [esp + 0x10]
mov ebx, str.ScreenSaveBackup
jmp loc.00404b58
push esi
push 0x2080
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40123f
push esi
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40123f
push str.scrnsave.scr
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x401245
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], esi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x4029e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_Acrobat9.0Security
push 0x80000002
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a54
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x4042a0
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a49
xor edx, edx
cmp dword [esp + 4], edx
setne dl
mov esi, edx
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x402bb0
Capabilities:
Accept command line arguments

Disassembly:
call fcn.00402a60
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00402af0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
ret 0x10
Function at 0x40db23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40db32
pop dword [ebp - 0x4c]
mov eax, 0x90e79ce
sub eax, 0x8cd9e9c
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e723
push 0
mov eax, 0x5f4e1acc
add eax, 0xa0f43654
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5036
mov edi, eax
mov esi, 0xc49fbc5a
sub esi, 0xc45c8e5a
add esi, dword [ebp - 0x4c]
mov ebx, 0x52ddfbf9
add ebx, 0x29288d97
xor dword [ebp - 0x28], 0x2639bfda
mov edx, dword [esi]
xor dword [ebp - 0x40], ebx
add edx, ebx
sub dword [ebp - 0x48], 0x452f910c
mov dword [edi], edx
add edi, 0x34e92809
add edi, 0xcb16d7fb
add esi, 0xc5598768
sub esi, 0xc5598764
loop 0x40db8b
add eax, 0x133ab
xor ebx, ebx
add ebx, eax
add eax, 0xd1cf11ce
sub eax, 0xd1cf11c9
mov ecx, 0x44d4967
add ecx, 0xfbf2b699
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6a306420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.6a30619b
mov ebp, 0x8dd14450
inc ebp
test al, 0x50
call fcn.6a3061ab
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.6a306160
add esp, 0x10
lea ecx, [ebp - 0xb0]
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x6a306489
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.6a30619b
idiv dword [eax]
enter 0xffffffffffff8d9c, 0x45
rcl byte [eax - 0x18], 0xc5
cld
invalid