joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460fd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4e4c94]
cmp dword [eax + 0x30], 0
je 0x46107a
cmp dword [ebx + 0x94], 0
jne 0x461074
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460f60
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461074
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46103a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461074
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c7d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x461049
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461b58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x461b8d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040478c
jmp 0x461b9a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046f0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x462ad4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462b15
mov eax, esi
call fcn.00447f84
test al, al
je 0x462b15
mov eax, dword [ebx + 0x84]
call fcn.00447c80
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462b15
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447c80
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x463dc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b3c
xor eax, eax
push ebp
push 0x463e3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b4c
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x463e09
mov eax, dword [ebx + 4]
call fcn.00404b4c
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463e45
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x464e40
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464fdd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b0c
cmp word [ebx + 0xa2], 0
je 0x464e89
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x464e9d
lea esi, [ebp - 8]
jmp 0x464e9f
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x464eac
xor edi, edi
jmp 0x464eb9
mov eax, dword [ebx + 0x80]
call fcn.00404b4c
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404b4c
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00464578
mov eax, dword [ebp - 0x14]
call fcn.00404b4c
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404b4c
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404b4c
push eax
mov eax, ebx
call fcn.004646ac
push eax
mov eax, ebx
call fcn.00464680
push eax
mov eax, ebx
call fcn.00464634
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00464444
mov eax, dword [ebp - 0x18]
call fcn.00404b4c
push eax
mov eax, dword [ebx + 8]
call fcn.00404b4c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x464f42
call fcn.0040df60
xor edx, edx
push ebp
push 0x464fbb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x464f80
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x464f76
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x464fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464fc2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x464fec
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x465018
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404b4c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46503d
call fcn.0040df60
xor eax, eax
push ebp
push 0x465074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x46505d
call fcn.0040df60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46507b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x465e44
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x465fad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404734
mov eax, dword [ebp - 0x10]
call fcn.00465b70
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x465e96
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404bec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00466284
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x465f6b
xor eax, eax
push ebp
push 0x465f64
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00465d1c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00465fdc
test al, al
je 0x465f42
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.0040478c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x465f42
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404b4c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x465f3c
mov eax, dword [ebp - 0x14]
call fcn.00404b4c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040488c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00465e44
dec ebx
cmp ebx, 0xffffffff
jne 0x465ef5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465f6b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00465d1c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404b4c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00465d08
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465fb4
lea eax, [ebp - 0x3c]
call fcn.0040469c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004046c0
ret

Function at 0x465fdc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403130
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4e3c18]
cmp byte [edx + 0xc], 0
je 0x466040
mov edx, dword [0x4e3c0c]
cmp dword [edx], 2
jne 0x466040
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x466198
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00465b84
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404b4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4661f6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e395c]
mov dl, 1
mov eax, dword [0x465a7c]
call fcn.0040ca60
call fcn.0040403c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x466200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404b4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x466258
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e3c24]
mov dl, 1
mov eax, dword [0x465a7c]
call fcn.0040ca60
call fcn.0040403c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00465bb4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x466908
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x466928
push 0
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
jmp 0x4669f1
mov eax, dword [esi + 0x18]
push eax
mov ecx, dword [esi + 0x14]
mov dl, 1
mov eax, dword [0x4663f0]
call fcn.00466690
mov ebx, eax
mov dword [esi + 0x38], ebx
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x40], 0x466a94
mov eax, ebx
call fcn.00424d8c
mov eax, dword [esi + 0x1c]
call fcn.00404b4c
push eax
mov eax, dword [esi + 0x20]
push eax
push 0
push 4
push 0x4e4cc8
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [esi + 4], eax
mov eax, dword [esi + 0x24]
call fcn.00404b4c
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 4
push 0x4e4cc8
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
jbe 0x4669cb
cmp dword [esi + 4], 0
jbe 0x4669cb
push 0
push 0
push 0
push 0
push 2
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov dword [esi + 0xc], eax
push 0
push 0
push 0
push 0
push 2
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov dword [esi + 0x10], eax
jmp 0x4669d5
xor eax, eax
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x38]
mov bl, byte [eax + 0x48]
test bl, bl
je 0x4669f1
cmp dword [esi + 0xc], 0
je 0x4669eb
cmp dword [esi + 0x10], 0
jne 0x4669ef
xor ebx, ebx
jmp 0x4669f1
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4b6914
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6abb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x11b], 0x12
test byte [ebx + 0x1c], 0x10
jne 0x4b6a9d
mov eax, ebx
call fcn.004c0988
test byte [eax + 0x2ec], 8
jne 0x4b6a9d
push 0
mov eax, ebx
call fcn.004c09ac
push eax
push 0x4514
mov eax, ebx
call fcn.004c09ac
push eax
call sub.user32.dll_SendMessageA
dec eax
je 0x4b6a9d
cmp word [ebx + 0x1ba], 0
je 0x4b69a6
mov byte [ebp - 1], 1
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0x1bc]
call dword [ebx + 0x1b8]
cmp byte [ebp - 1], 0
je 0x4b6a9d
mov eax, ebx
call fcn.004c0988
test eax, eax
je 0x4b6a9d
mov al, byte [ebx + 0x50]
cmp al, 4
je 0x4b6a92
mov byte [ebx + 0xa1], al
mov byte [ebx + 0x50], 4
cmp byte [ebx + 0x51], 0
jne 0x4b69fe
mov al, byte [ebx + 0xa1]
cmp al, 2
je 0x4b69fe
cmp al, 1
je 0x4b69fe
cmp al, 3
je 0x4b69fe
mov eax, ebx
call fcn.004c0988
lea edx, [ebp - 0x14]
call fcn.00440f5c
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x91]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x64], 0
je 0x4b6a46
lea edx, [ebp - 0x18]
mov eax, dword [0x4e3a0c]
mov eax, dword [eax]
call fcn.00461b58
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0xbc]
mov ecx, 0x3f
call fcn.004099bc
mov eax, dword [0x4e3a0c]
mov eax, dword [eax]
call fcn.0046196c
push 0
mov eax, dword [0x4e3a0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4b6a82
mov eax, ebx
call fcn.004c0988
test eax, eax
je 0x4b6a73
mov eax, ebx
call fcn.004c0988
lea edx, [ebp - 0x1c]
call fcn.004415bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0xbc]
mov ecx, 0x3f
call fcn.004099bc
push 0
mov eax, ebx
call fcn.004c09ac
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebx + 0xa4]
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
jmp 0x4b6a99
mov eax, ebx
call fcn.004b63ac
mov byte [ebx + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6ac2
lea eax, [ebp - 0x1c]
call fcn.0040469c
lea eax, [ebp - 0x18]
call fcn.0040469c
ret
Function at 0x4cb494
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cb4bb
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cb4cd
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x4cb4d9
add word [ebp - 6], 0x8000
mov byte [ebp - 0xd], 0
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004cb324
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cb526
xor eax, eax
push ebp
push 0x4cb51f
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 4]
xor edx, edx
call fcn.004cb354
pop ecx
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb526
ret
cmp byte [ebp - 0xd], 2
je 0x4cb4d9
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d43d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4e35e0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4d43bb
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004d4350
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ceefc]
call fcn.004d43f8
mov dword [0x4e3644], eax
mov eax, dword [ebp - 4]
call fcn.004d4300
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d43d8
lea eax, [ebp - 8]
call fcn.00406790
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x1a3a4972
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x3c207d3a
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov bl, byte [eax]
cmp bl, 0xd8
je 0x40102e
cmp bl, 0xd7
je 0x40102e
mov esi, dword [ebp + 0x10]
lea ecx, [eax + 1]
test esi, esi
jle 0x40104f
mov eax, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x401023
jmp 0x40104f
mov esi, dword [ebp + 0xc]
inc eax
push esi
push eax
call fcn.00401ac0
cmp bl, 0xd8
jne 0x40104f
xor eax, eax
cmp dword [ebp + 0x10], eax
jle 0x40104f
xor byte [eax + esi], 0xf0
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x401045
pop esi
pop ebx
pop ebp
ret

Function at 0x4010c1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push dword [esp + 0x14]
push esi
push 0x8000040
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4010fc
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x40112a
push 0x40
push 0x101000
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40112a
push esi
mov eax, 0x401130
push esi
push eax
push eax
push 0x80030008
call fcn.00401057
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4011f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40d5f4], 0
push esi
jne 0x401227
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x401201
mov dword [ecx*4 + 0x40d5f0], eax
inc ecx
cmp ecx, 0x100
jl 0x4011fc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x401258
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40d5f0]
xor eax, esi
inc ecx
dec edx
jne 0x40123a
pop edi
not eax
pop esi
ret 0xc
Function at 0x4030f3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x480010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x403187
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x403144
cmp dword [ebp + 0x10], ebx
jne 0x40317b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.004030f3
test eax, eax
jne 0x403156
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x40312b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00408a8e
cmp eax, ebx
je 0x40318e
push ebx
push dword [0x480010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x403187
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x480010], ebx
jne 0x403184
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x403184
jmp 0x403187
Function at 0x405c5e
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x100c], 0
jne 0x405cb4
inc dword [0x477f54]
mov eax, dword [0x477f54]
or dword [esi + 0x1010], 2
push 0x40
push 0x1000
push 0xa
push 0
mov dword [esi + 0x1c98], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x100c], eax
mov byte [eax], 0xb8
inc eax
mov ecx, 0x408d27
mov dword [eax], esi
add eax, 4
mov byte [eax], 0xe9
inc eax
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [esi + 0x100c]
pop esi
ret

Function at 0x405e2f
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x477f50
push 0x40
push 4
push 0x477f60
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov byte [0x477f60], 0xc2
mov dword [0x477f50], eax
mov dword [0x477f58], eax
mov dword [0x477f68], eax
mov dword [0x477f5c], eax
mov dword [0x477f54], eax
mov byte [0x477f62], al
ret
Function at 0x405f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [0x47ff90]
push edi
push 6
call fcn.00408a8e
xor ebp, ebp
cmp eax, ebp
je 0x405f3b
push 0x4e1000
call eax
movzx eax, ax
cdq
push edx
push eax
call fcn.00404d49
jmp 0x405f95
mov edi, 0x454808
push ebp
push edi
push ebp
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov word [0x4e1000], 0x30
mov word [0x4e1002], 0x78
mov word [0x4e1004], bp
call fcn.004084b4
cmp word [0x454808], bp
jne 0x405f8a
push ebp
push edi
push 0x40a4dc
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.004084b4
push edi
push 0x4e1000
call sub.KERNEL32.dll_lstrcatW
call fcn.00406170
mov eax, dword [0x47ff98]
mov ebx, 0x4d5000
and eax, 0x20
push ebx
mov dword [0x47ffe0], eax
mov dword [0x47fffc], 0x10000
call fcn.00408112
test eax, eax
jne 0x406050
mov ecx, dword [esi + 0x40]
cmp ecx, ebp
je 0x406050
mov edx, dword [esi + 0x44]
mov eax, dword [0x47ffb8]
mov edi, 0x46eee0
push ebp
lea edx, [eax + edx*2]
push edi
lea eax, [eax + ecx*2]
push edx
push eax
push dword [esi + 0x3c]
call fcn.004084b4
mov ax, word [0x46eee0]
cmp ax, bp
je 0x406050
cmp ax, 0x22
jne 0x40600f
mov edi, 0x46eee2
push 0x22
push edi
call fcn.00408037
mov word [eax], bp
push edi
call sub.KERNEL32.dll_lstrlenW
lea eax, [edi + eax*2 - 8]
cmp eax, edi
jbe 0x406043
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406043
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40603d
test al, 0x10
jne 0x406043
push edi
call fcn.00408056
push edi
call fcn.0040800a
push eax
push ebx
call fcn.0040852e
push ebx
call fcn.00408112
test eax, eax
jne 0x406066
push dword [esi + 0x104]
push ebx
call fcn.00408550
test byte [0x47ff98], 0x10
je 0x406086
cmp dword [0x47ff9c], ebp
jne 0x406086
call fcn.00405eef
mov dword [0x46eec0], 1
push 0x8040
push ebp
push ebp
push 1
push 0x67
push dword [0x47ff80]
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [0x477f48], eax
call fcn.00405e2f
push ebp
call fcn.004012fc
test eax, eax
je 0x4060b9
push 2
pop eax
jmp 0x40616b
call fcn.00406170
cmp dword [0x480000], ebp
jne 0x406140
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RichEd20
call esi
test eax, eax
jne 0x4060de
push str.RichEd32
call esi
mov edi, dword [sym.imp.USER32.dll_GetClassInfoW]
mov esi, 0x477f00
mov ebx, str.RichEdit20A
push esi
push ebx
push ebp
call edi
test eax, eax
jne 0x40610d
push esi
push str.RichEdit
push ebp
call edi
push esi
mov dword [0x477f24], ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x477f40]
push ebp
add eax, 0x69
push 0x406232
movzx eax, ax
push ebp
push eax
push dword [0x47ff80]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 5
mov esi, eax
call fcn.004012fc
push 1
call fcn.00404a58
mov eax, esi
jmp 0x40616b
push ebp
call fcn.004078e5
test eax, eax
je 0x406162
cmp dword [0x477f2c], ebp
jne 0x4060b1
push 2
call fcn.004012fc
jmp 0x4060b1
push 1
call fcn.004012fc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407d15
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x46cc10], 0x44
push eax
xor eax, eax
push 0x46cc10
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407d50
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4