joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536034
Capabilities:
Packed with generic packer

Disassembly:
clc
jae 0x53603a
outsd dx, dword [esi]
cld
scasb al, byte es:[edi]
pushal
stc
jmp 0x536043
call 0x536051
pop ebx
stc
xor bh, byte [ebx + 0x79659030]
xor ebx, dword [ebx + 0x72]
push es
pop eax
call 0x8320cc95
add ebx, 0xffffffb8
jmp 0x536069
cmp dword [ebx], 0
stc
jmp 0x536070
je 0x5360ee
clc
jmp 0x53607e
mov ecx, ebx
jmp 0x536089
add ebx, 4
jmp 0x536090
mov eax, dword [ebx]
jmp 0x536098
add eax, ebx
clc
jae 0x53609e
xchg ebx, eax
mov edx, dword [ebx + 4]
jmp 0x5360aa
sub dword [eax], 0x50e51ea9
jmp 0x5360b4
add eax, 4
jmp 0x5360be
sub edx, 1
jmp 0x5360c7
jne 0x5360a1
jmp 0x5360d1
add ebx, 8
jmp 0x5360d8
sub dword [ecx], 1
jmp 0x5360df
jne 0x53608c
stc
jmp 0x5360e9
call fcn.005360fc
jmp 0x5360f2
popal
clc
jmp 0x5360f7
jmp 0x483dc5
Function at 0x40ad5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40ae72
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405c66
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40adb3
mov byte [ebp - 2], 0
jmp 0x40addd
call 0x40e9d8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40adfc
cmp al, 0x7f
ja 0x40adfc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40ae1b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call 0x40e9c0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call 0x40e9b4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call 0x40e9b4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40ad90
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x264f5226
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x183a266c
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x491bfd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
lea eax, [ebp - 0x104]
push eax
call fcn.00491d53
push 0x401065
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x491ccf
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401074
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x491d0f
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x40106f
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x491d0f
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x491cb4
mov word [ebx], 0x5c
push 0x40101c
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x491d0f
mov dword [ebp - 0x108], eax
push 0x40100b
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x491d04
push 0x3e8
call eax
test eax, eax
je 0x491d04
call 0x491cf4
add dword [esp], 0x1e7b
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401016
push 0x401026
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x1a75cb8
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x1a75cef
mov esp, ebp
pop ebp
ret
Function at 0x401503
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, str.iw.ico
movzx eax, ax
mov edx, eax
mov eax, dword [0x407080]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._LoadIconA_8
sub esp, 8
mov dword [0x4070cc], eax
mov eax, dword [0x4070cc]
mov edx, eax
mov eax, dword [0x4070d0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
mov eax, dword [0x4070cc]
mov edx, eax
mov eax, dword [0x4070d0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [0x407080], eax
mov eax, dword [0x407080]
mov dword [0x4070b0], eax
mov dword [0x4070c4], 0x405078
mov dword [0x4070c0], 0x405081
mov dword [0x4070a4], 0x401460
mov eax, dword [0x4070cc]
mov dword [0x4070b4], eax
mov dword [esp], 0x4070a0
call sym._RegisterClassA_4
sub esp, 4
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x12c
mov dword [esp + 0x18], 0x2bc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xca0000
mov dword [esp + 8], str.KEY_CODE_VIEVER
mov dword [esp + 4], str.WinClsss
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [0x4070d0], eax
mov eax, dword [0x4070d0]
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov eax, dword [0x4070d0]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.Down_Keyboard_
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [0x4070d4], eax
call sym._setFont
mov eax, dword [0x4070d4]
mov dword [esp], eax
call sym._UpdateWindow_4
sub esp, 4
mov eax, dword [0x4070d0]
mov dword [esp], eax
call sym._UpdateWindow_4
sub esp, 4
jmp 0x40170b
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
jne 0x4016ef
nop
leave
ret
Function at 0x401e30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401e7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e74
test esi, esi
je 0x401e74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e50
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402060
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402188
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020ee
cmp eax, 4
jne 0x402110
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020fe
cmp edx, 4
je 0x4020fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402060
Function at 0x401200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8c0160]
mov ecx, dword [0x8bf0b4]
shr eax, 3
sub esp, 0x81c
test eax, eax
jbe 0x4012f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x8c0160], 0x959
jne 0x4012d6
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.ducofikinevodugucexejayeyide_jofubupazekatajikuwayoj
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
lea eax, [ebp - 0x81c]
push eax
push 0
push str.lebogegimoramigefunolerulodidi_peyewuvuhicucalikid_suyucedizejabije
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
push str.laduvig_xupewufodarahut
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
push edx
call fcn.00401020
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402550
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a00c8]
jne 0x40255a
repz ret
jmp fcn.00405eee

Function at 0x405b1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402fd9
and dword [ebp - 4], 0
cmp dword [0x4a1b28], 0
mov ebx, eax
jne 0x405bcc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405c7d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405c7d
push eax
call fcn.00402f67
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a1b28], eax
call esi
push eax
call fcn.00402f67
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a1b2c], eax
call esi
push eax
call fcn.00402f67
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a1b30], eax
call esi
push eax
call fcn.00402f67
pop ecx
mov dword [0x4a1b38], eax
test eax, eax
je 0x405bcc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f67
pop ecx
mov dword [0x4a1b34], eax
mov eax, dword [0x4a1b34]
cmp eax, ebx
je 0x405c24
cmp dword [0x4a1b38], ebx
je 0x405c24
push eax
call fcn.00402fe2
push dword [0x4a1b38]
mov esi, eax
call fcn.00402fe2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c24
test edi, edi
je 0x405c24
call esi
test eax, eax
je 0x405c1b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405c1b
test byte [ebp - 0xc], 1
jne 0x405c24
or dword [ebp + 0x10], 0x200000
jmp 0x405c5d
mov eax, dword [0x4a1b2c]
cmp eax, ebx
je 0x405c5d
push eax
call fcn.00402fe2
pop ecx
test eax, eax
je 0x405c5d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c5d
mov eax, dword [0x4a1b30]
cmp eax, ebx
je 0x405c5d
push eax
call fcn.00402fe2
pop ecx
test eax, eax
je 0x405c5d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a1b28]
call fcn.00402fe2
pop ecx
test eax, eax
je 0x405c7d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405c7f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x1db247b2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2220504b
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402070
Capabilities:
List user accounts

Disassembly:
push 0xffffffffffffffff
push 0x4720f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491050]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], edi
lea ecx, [ecx]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 2
push edi
push edi
call sub.NETAPI32.dll_NetUserEnum
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, edi
je 0x4020fd
cmp esi, 0xea
je 0x4020fd
push esi
push str.A_system_error_has_occurred:__d_n
call fcn.0043e790
add eax, 0x40
push eax
call fcn.0043e4f0
add esp, 0xc
jmp 0x4021e8
mov ebx, dword [esp + 0x14]
cmp ebx, edi
je 0x4021fc
xor ebp, ebp
cmp dword [esp + 0x18], edi
jbe 0x4021e8
cmp ebx, edi
je 0x4021a2
mov ecx, dword [ebx]
push ecx
lea ecx, [esp + 0x28]
call fcn.0040be20
lea edx, [esp + 0x24]
push edx
mov ecx, 0x497c88
mov dword [esp + 0x40], edi
call fcn.00411220
mov dword [esp + 0x3c], 0xffffffff
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x402172
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x402172
int3
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x402188
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
inc dword [esp + 0x20]
mov esi, dword [esp + 0x28]
inc ebp
add ebx, 4
xor edi, edi
cmp ebp, dword [esp + 0x18]
jb 0x402115
jmp 0x4021e8
push 0x4878c0
lea ecx, [esp + 0x20]
push str.c:zvDPREP.log
push ecx
call fcn.0043ec90
add esp, 0xc
test eax, eax
jne 0x4021e8
mov edx, dword [esp + 0x1c]
push edx
push str._tAn_access_violation_has_occurred_in_Enumerating_userNames_n
call fcn.0043ed30
mov eax, dword [esp + 0x24]
push eax
push 0x4878d4
call fcn.0043ed30
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0043efd0
add esp, 0x14
mov ebx, dword [esp + 0x14]
cmp ebx, edi
je 0x4021fc
push ebx
call sub.NETAPI32.dll_NetApiBufferFree
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp esi, 0xea
je 0x4020b0
cmp ebx, edi
je 0x402212
push ebx
call sub.NETAPI32.dll_NetApiBufferFree
mov edx, dword [esp + 0x20]
push edx
push str._nTotal_of__d_entries_enumerated_n
call fcn.0043e790
add eax, 0x40
push eax
call fcn.0043e4f0
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4022a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x491050]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x118]
push 0x486f97
push 0x104
push esi
call fcn.0043dc50
add esp, 0xc
lea eax, [esp + 4]
push eax
push 1
push 0
push ebx
push edi
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402371
push 0x486f97
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0043dc50
mov ecx, dword [esp + 0x10]
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402366
mov edx, dword [esp + 8]
mov byte [esp + edx + 0xc], al
lea eax, [esp + 0xc]
push eax
push 0x104
push esi
call fcn.0043dc50
mov ecx, dword [esp + 0x10]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00439cd0
add esp, 0x110
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00439cd0
add esp, 0x110
ret
Function at 0x404ac0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x471f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x491050]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491050]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
push 0x4955b8
lea eax, [esp + 0x40]
push 0x104
push eax
call fcn.0043dc50
add esp, 0xc
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str..
lea edx, [esp + 0x40]
push 0x104
push edx
call fcn.0043e110
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.00411540
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x158], 0
call fcn.004116f0
test eax, eax
je 0x404c51
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call fcn.00411d20
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], eax
call fcn.00411c80
test eax, eax
jne 0x404c46
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
call fcn.00411f20
mov eax, dword [eax]
push eax
push 0x4955b8
call fcn.0044fd00
mov esi, dword [esp + 0x24]
add esp, 8
test eax, eax
setne bl
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x404bd5
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x404bd5
int3
or edx, 0xffffffff
lock xadd dword [edi], edx
dec edx
test edx, edx
jg 0x404beb
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
test bl, bl
je 0x404c46
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
call fcn.00411f20
mov eax, dword [eax]
push eax
call ebp
mov esi, dword [esp + 0x20]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x404c30
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.00439d00
add esp, 0x14
cmp eax, 1
jne 0x404c30
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x404c46
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp dword [esp + 0x18], 0
jne 0x404b66
lea ecx, [esp + 0x24]
mov dword [esp + 0x150], 0xffffffff
call fcn.004115d0
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00439cd0
add esp, 0x140
ret
Function at 0x407790
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x491050]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x4889c0
lea eax, [esp + 4]
push 0x104
push eax
call fcn.0043dc50
add esp, 0xc
push 0x4955b8
push 0x104
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push edx
push esi
push str.data
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x104]
push 0x487798
push eax
call fcn.0044fd00
add esp, 8
test eax, eax
jne 0x40780e
mov al, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00439cd0
add esp, 0x20c
ret
push 0x4955b8
push 0x487798
push esi
push str.data
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor al, al
call fcn.00439cd0
add esp, 0x20c
ret