joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x65
mov dword [ebp - 8], 0
jmp 0x10016b42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x10016b81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2ad1ba98]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10016b7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016b39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ab80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
call fcn.10001460
movzx eax, al
test eax, eax
je 0x1001abfe
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
push 0
push 0x1fffff
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x10048824]
mov eax, dword [edx + 0x11c]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1001abf9
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10048830]
call fcn.1001a040
mov eax, dword [ebp - 8]
jmp 0x1001acce
jmp 0x1001accc
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [0x10048824]
mov eax, dword [edx + 0x114]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001accc
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.1001afe0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jae 0x1001acb8
mov byte [ebp - 0x34], 0x54
mov byte [ebp - 0x33], 0x68
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x71
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x66
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10048830]
call fcn.1001a040
mov eax, dword [ebp - 8]
jmp 0x1001acce
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001dda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0
jmp 0x1001ddc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x1001de01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x16c2867b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001ddfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001ddb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5f
mov dword [ebp - 8], 0
jmp 0x1001de42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x1001de81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7161b027]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001de7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001de39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001dea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc2
mov dword [ebp - 8], 0
jmp 0x1001dec2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jge 0x1001df01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0xf03ad50]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001defc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001deb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1a], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001df20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa7
mov dword [ebp - 8], 0
jmp 0x1001df42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x1001df81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2079c0a8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001df7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001df39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0
jmp 0x1001dfc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1001e001
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x53062dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001dffc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001dfb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001e260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.1001e090
movzx eax, al
test eax, eax
je 0x1001e36c
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x20
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x7a
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x21
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x3a
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0
mov ecx, dword [0x10048828]
call fcn.10001480
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x1004882c]
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10020000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047b44]
jne 0x1002000a
repz ret
jmp fcn.1002065c
Function at 0x10021cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10021dd8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10021dd8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10021dd8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10020a00
add esp, 0x10
cmp eax, 2
je 0x10021d19
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x10021d0d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10020a00
add esp, 0x10
cmp eax, 4
jne 0x10021d0d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10021d48
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10020a00
add esp, 0x10
cmp eax, 2
jne 0x10021d0d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10021da3
cmp eax, 0x8664
jne 0x10021d0d
push 0x108
push ebx
push edi
push esi
call fcn.10020a00
add esp, 0x10
cmp eax, 0x108
jne 0x10021d0d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10020a00
add esp, 0x10
cmp eax, 0xf8
jne 0x10021d0d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x53966569
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x464f5890
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40160a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x401697
cmp dword [esi + 8], ebx
je 0x401697
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], SysReAllocString
call fcn.004014e3
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401697
cmp dword [ebp - 4], ebx
je 0x401697
cmp dword [esi + 0x14], 1
jne 0x401665
push 4
lea eax, [esi + 0x10]
push eax
push 4
jmp 0x401679
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x40168e
push eax
call fcn.0042a240
pop ecx
push eax
push dword [esi + 0xc]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x402155
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc78
mov eax, dword [0x44c750]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, 0x400
push eax
lea ecx, [ebp - 0xc6c]
push ecx
lea ecx, [ebp - 0xc74]
push ecx
lea ecx, [ebp - 0xc78]
push ecx
lea ecx, [ebp - 0xc70]
push ecx
push eax
lea eax, [ebp - 0x86c]
push eax
push 0x43d718
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
xor esi, esi
test eax, eax
jne 0x4021aa
mov dword [ebp - 0xc70], esi
push str.wrapper
push dword [ebp - 0xc70]
lea eax, [ebp - 0x46c]
push str.game
push str._s_lu_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004189ad
lea eax, [ebp - 0x46c]
push eax
call fcn.0042a240
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004189f3
lea eax, [ebp - 0x6c]
push eax
call fcn.00418a79
mov edi, dword [ebp + 8]
push str.xxxx_xxxx_xxxx_xxxx
push edi
call fcn.0042a630
push str.ACDEFHJKMNPRSTWXYZ2345679
call fcn.0042a240
add esp, 0x3c
mov ebx, eax
lea ecx, [ebp - 0x14]
cmp esi, 4
je 0x40223c
cmp esi, 9
je 0x40223c
cmp esi, 0xe
je 0x40223c
movzx eax, byte [ecx]
xor edx, edx
div ebx
inc ecx
mov al, byte [edx + str.ACDEFHJKMNPRSTWXYZ2345679]
mov byte [esi + edi], al
inc esi
cmp esi, 0x13
jb 0x40221c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0042a57e
leave
ret

Function at 0x402e57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
cmp ebx, esi
push edi
mov edi, dword [ebp + 8]
mov ecx, ebx
jae 0x402e81
xor edx, edx
mov eax, ecx
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov al, byte [edx + eax]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x402e6c
push dword [ebp + 0x1c]
sub esi, ebx
push esi
add edi, ebx
push edi
call fcn.004025a8
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402ee8
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x44c750]
push ebx
push 0
push 2
mov dword [ebp + 0xac], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402f96
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push eax
push ebx
mov dword [ebp - 0x7c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x402f92
push esi
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0xb8]
call fcn.0042af0d
test eax, eax
pop ecx
pop ecx
jne 0x402f83
push dword [ebp - 0x74]
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x80], 0x103
jne 0x402f80
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
lea eax, [ebp - 0x7c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402f3d
pop esi
push ebx
call edi
pop edi
mov ecx, dword [ebp + 0xac]
pop ebx
call fcn.0042a57e
add ebp, 0xb0
leave
ret

Function at 0x4033d8
Capabilities:
Set current directory
Terminate process

Disassembly:
mov eax, dword [0x548168]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x4033ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xc], bl
je 0x403400
push 1
push 0x547640
call fcn.00414b5e
pop ecx
pop ecx
cmp byte [0x5481d9], bl
je 0x40343c
cmp dword [0x548214], ebx
je 0x40343c
cmp dword [0x548218], ebx
je 0x40343c
mov eax, dword [0x54821c]
cmp eax, ebx
je 0x40343c
push eax
call fcn.0042b119
push eax
push dword [0x548218]
push dword [0x548214]
call fcn.004031c2
add esp, 0x10
mov ecx, dword [0x548164]
cmp ecx, ebx
mov esi, ecx
je 0x403454
call fcn.00417482
push esi
call fcn.0042a1fb
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40345d
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x4dc]
sub esp, 0x55c
mov eax, dword [0x44c750]
push ebx
push esi
push edi
push 0x44
pop esi
push esi
mov dword [ebp + 0x4d8], eax
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00429cb0
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x80], esi
call fcn.00429cb0
mov esi, 0x547748
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0042a630
push dword [0x54820c]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a640
add esp, 0x28
cmp dword [ebp + 0x4e4], ebx
mov edi, 0x43d850
je 0x4034f2
push dword [ebp + 0x4e4]
call fcn.0042a240
test eax, eax
pop ecx
jbe 0x4034f2
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0042a640
push dword [ebp + 0x4e4]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a640
add esp, 0x10
push dword [0x548224]
call fcn.0042a240
test eax, eax
pop ecx
jbe 0x40351e
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0042a640
push dword [0x548224]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a640
add esp, 0x10
lea eax, [ebp + 0x3d4]
push esi
push eax
call fcn.0042a630
push dword [0x54820c]
lea eax, [ebp + 0x3d4]
push eax
call fcn.0042a640
lea eax, [ebp + 0x3d4]
push 0x5c
push eax
call fcn.0042aee0
add esp, 0x18
cmp eax, ebx
je 0x403562
mov byte [eax + 1], bl
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push ebx
push dword [0x54816c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 1
call fcn.004033d8
int3
Function at 0x40a4d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x43bbce
call fcn.0042a1dc
sub esp, 0x420
mov eax, dword [0x44c750]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x44b0b4]
xor ebx, ebx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 1
je 0x40a580
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov edi, 0x400
cmp esi, edi
jg 0x40a560
push esi
call fcn.0040169d
test al, al
pop ecx
je 0x40a560
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0042a510
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x40a56c
push esi
lea ecx, [ebp - 0x420]
call fcn.00405f17
push dword [ebp - 0x41c]
push esi
push dword [ebp + 8]
push eax
call fcn.004017f2
cmp eax, ebx
jne 0x40a5a3
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40a599
lea ecx, [ebp - 0x418]
call fcn.0040a6d6
mov esi, 0x8007000e
jmp 0x40a6aa
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
jne 0x40a5c3
call fcn.00406f2d
mov esi, eax
jmp 0x40a691
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x40a5ed
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x424], eax
jne 0x40a5f7
call fcn.00406f2d
jmp 0x40a683
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, edi
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
jbe 0x40a628
push eax
lea ecx, [ebp - 0x418]
call fcn.0040b90c
jmp 0x40a63b
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x40a63b
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 4], 1
jne 0x40a651
mov esi, 0x8007000e
jmp 0x40a685
push esi
push dword [ebp - 0x424]
push dword [ebp - 0x418]
call fcn.0042ab10
mov eax, dword [ebp - 0x418]
add esp, 0xc
push dword [ebp + 0x14]
mov byte [esi + eax], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0040a6ec
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40a6aa
lea ecx, [ebp - 0x418]
call fcn.0040a6d6
lea ecx, [ebp - 0x420]
call fcn.00402faa
mov eax, esi
lea esp, [ebp - 0x438]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042a57e
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40b380
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x44c750]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.0040b2b1
cmp eax, esi
jne 0x40b408
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40b3d1
lea eax, [ebp - 0x70]
push eax
call fcn.0040b380
cmp eax, esi
jne 0x40b407
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x40b3c4
call fcn.0040b29a
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040b29a
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.0042a57e
add ebp, 0x94
leave
ret 4
Function at 0x40b818
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40b823
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40dc0f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x44c750]
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00429cb0
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 5
mov ecx, dword [ebp - 4]
seta al
call fcn.0042a57e
leave
ret

Function at 0x40dd02
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x44c750]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push edi
mov edi, 0x100
mov dword [ebp + 0x3a0], eax
xor ebx, ebx
push edi
lea eax, [ebp + 0x1a0]
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x69], bl
push ebx
jmp 0x40ddd9
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1a0]
push eax
push dword [ebp + 0x3ac]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ddcb
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.GDFBinaryPath
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ddbd
push dword [ebp + 0x3b0]
lea eax, [ebp - 0x68]
push eax
call fcn.0042b673
test eax, eax
pop ecx
pop ecx
jne 0x40ddbd
push dword [ebp + 0x3b4]
lea eax, [ebp + 0x1a0]
push eax
mov byte [ebp - 0x69], 1
call fcn.0040dc61
pop ecx
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x69], bl
jne 0x40dde9
inc dword [ebp - 0x70]
push edi
lea eax, [ebp + 0x1a0]
push eax
push dword [ebp - 0x70]
push dword [ebp + 0x3ac]
call esi
test eax, eax
je 0x40dd42
mov ecx, dword [ebp + 0x3a0]
mov al, byte [ebp - 0x69]
pop edi
pop esi
pop ebx
call fcn.0042a57e
add ebp, 0x3a4
leave
ret