joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0040e190
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x18], eax
cmp dword [ebp + 8], 0
je 0x4024f5
cmp dword [ebp + 0xc], 0
jle 0x4024f5
cmp dword [ebp + 0x10], 0
je 0x4024f5
cmp dword [ebp + 0x14], 0
jle 0x4024f5
cmp dword [ebp + 0x18], 0
jne 0x4024fc
xor eax, eax
jmp 0x4026ec
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402533
cmp dword [ebp - 0xc], 2
jge 0x40253a
xor eax, eax
jmp 0x4026ec
mov dword [ebp - 0x10], 1
jmp 0x40254c
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4026d3
xor ecx, ecx
mov word [ebp - 0x1028], cx
push 0x7fe
push 0
lea edx, [ebp - 0x1026]
push edx
call fcn.00405360
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4]
push edx
push 0x400
lea eax, [ebp - 0x1028]
push eax
call fcn.004041b4
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x818], cx
push 0x7fe
push 0
lea edx, [ebp - 0x816]
push edx
call fcn.00405360
add esp, 0xc
call fcn.00402710
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x1028]
push eax
call fcn.00402700
add esp, 4
push eax
push 0x400
lea ecx, [ebp - 0x818]
push ecx
call fcn.004041b4
add esp, 0xc
push str._updatesucceed
lea edx, [ebp - 0x818]
push edx
call fcn.0040463f
add esp, 8
test eax, eax
jne 0x402607
mov dword [ebp - 8], 1
jmp 0x402543
push 0x3d
lea eax, [ebp - 0x818]
push eax
call fcn.004023f0
add esp, 8
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jne 0x40262c
jmp 0x402543
xor ecx, ecx
mov edx, dword [ebp - 0x820]
mov word [edx], cx
mov eax, dword [ebp - 0x820]
add eax, 2
mov dword [ebp - 0x820], eax
push str._from
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040463f
add esp, 8
test eax, eax
jne 0x40268b
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00405360
add esp, 0xc
mov ecx, dword [ebp - 0x820]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004041b4
add esp, 0xc
jmp 0x4026ce
push str._oldversion
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040463f
add esp, 8
test eax, eax
jne 0x4026ce
mov edx, dword [ebp + 0x14]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00405360
add esp, 0xc
mov ecx, dword [ebp - 0x820]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004041b4
add esp, 0xc
jmp 0x402543
cmp dword [ebp - 8], 0
je 0x4026e7
call fcn.00401960
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret
Function at 0x402e30
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c8], ecx
cmp dword [ebp + 8], 0
je 0x402e55
cmp dword [ebp + 0xc], 0
jne 0x402e5c
xor eax, eax
jmp 0x402f92
mov eax, 0x101
mov word [ebp - 0x1a4], ax
xor ecx, ecx
mov word [ebp - 0x198], cx
push 0x18e
push 0
lea edx, [ebp - 0x196]
push edx
call fcn.00405360
add esp, 0xc
lea eax, [ebp - 0x198]
push eax
movzx ecx, word [ebp - 0x1a4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402ea7
xor eax, eax
jmp 0x402f92
mov dword [ebp - 0x1c4], 0
xor edx, edx
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1b8], edx
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x1c0], 2
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1a0], 0
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
push 0
push str.version.kgb.docer.com
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x402f32
xor eax, eax
jmp 0x402f92
call dword [sym.imp.WS2_32.dll_WSACleanup]
test eax, eax
je 0x402f40
xor eax, eax
jmp 0x402f92
mov dword [ebp - 0x19c], 0
mov edx, dword [ebp - 0x1a0]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1a0], edx
cmp dword [ebp - 0x1a0], 0
jne 0x402f4a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x19c]
mov dl, byte [ecx + 4]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x19c]
mov dl, byte [ecx + 5]
mov byte [eax], dl
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret 8
Function at 0x402fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x81c], ecx
cmp dword [ebp + 8], 0
je 0x402fd5
cmp dword [ebp + 0xc], 0
jne 0x402fdc
xor eax, eax
jmp 0x403100
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x413414
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403009
xor eax, eax
jmp 0x403100
mov dword [ebp - 8], 0
xor ecx, ecx
mov word [ebp - 0x810], cx
push 0x7fe
push 0
lea edx, [ebp - 0x80e]
push edx
call fcn.00405360
add esp, 0xc
mov dword [ebp - 4], 0x800
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x41343c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4030f1
cmp dword [ebp - 8], 1
jne 0x4030f1
mov dword [ebp - 0x818], 0
lea ecx, [ebp - 0x818]
push ecx
push 0x41344c
lea edx, [ebp - 0x810]
push edx
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jne 0x4030a0
xor eax, eax
jmp 0x403100
mov eax, dword [ebp - 0x814]
push eax
call fcn.004049f2
add esp, 4
mov ecx, dword [ebp + 8]
mov byte [ecx], al
lea edx, [ebp - 0x818]
push edx
push 0x413450
push 0
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jne 0x4030dd
xor eax, eax
jmp 0x403100
mov eax, dword [ebp - 0x814]
push eax
call fcn.004049f2
add esp, 4
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret 8
Function at 0x403110
Capabilities:
Check if file exists
Create directory
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x62c], ecx
cmp dword [ebp + 8], 0
je 0x403135
cmp dword [ebp + 0xc], 0
jne 0x40313c
xor eax, eax
jmp 0x40330d
xor eax, eax
mov word [ebp - 0x628], ax
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.00405360
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x628]
push eax
call fcn.004041b4
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4031ab
push 0
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4031ab
xor eax, eax
jmp 0x40330d
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x420], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x41f]
push ecx
call fcn.00405360
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0x413454
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x403218
jmp 0x4032d4
push 0
push 0x4000000
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403244
jmp 0x4032d4
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40326d
jmp 0x4032d4
mov edx, 1
test edx, edx
je 0x4032cd
lea eax, [ebp - 4]
push eax
push 0x400
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x403298
jmp 0x4032d4
cmp dword [ebp - 4], 0
jne 0x4032a0
jmp 0x4032cd
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4032c7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
je 0x4032cb
jmp 0x4032d4
jmp 0x40326d
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4032ea
cmp dword [ebp - 0xc], 0xffffffff
je 0x4032ea
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4032fa
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0x18], 0
je 0x40330a
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret 8
Function at 0x4038e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x830], ecx
cmp dword [ebp + 8], 0
je 0x403911
cmp dword [ebp + 0xc], 0
je 0x403911
cmp dword [ebp + 0x10], 0
je 0x403911
cmp dword [ebp + 0x14], 0
jne 0x403918
xor eax, eax
jmp 0x403a9c
mov dword [ebp - 0x820], 0
xor eax, eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
push 0x41349c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403963
xor eax, eax
jmp 0x403a9c
mov dword [ebp - 8], 0
xor edx, edx
mov word [ebp - 0x810], dx
push 0x7fe
push 0
lea eax, [ebp - 0x80e]
push eax
call fcn.00405360
add esp, 0xc
mov dword [ebp - 4], 0x800
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x4134c4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403a8d
cmp dword [ebp - 8], 1
jne 0x403a8d
mov dword [ebp - 0x82c], 0
lea edx, [ebp - 0x82c]
push edx
push 0x4134d4
lea eax, [ebp - 0x810]
push eax
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x828], 0
jmp 0x403a08
mov ecx, dword [ebp - 0x828]
add ecx, 1
mov dword [ebp - 0x828], ecx
cmp dword [ebp - 0x828], 4
jge 0x403a54
cmp dword [ebp - 0x824], 0
je 0x403a54
mov edx, dword [ebp - 0x824]
push edx
call fcn.004049f2
add esp, 4
mov ecx, dword [ebp - 0x828]
mov dword [ebp + ecx*4 - 0x820], eax
lea edx, [ebp - 0x82c]
push edx
push 0x4134d8
push 0
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x824], eax
jmp 0x4039f9
cmp dword [ebp - 0x828], 4
jge 0x403a61
xor eax, eax
jmp 0x403a9c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x820]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x81c]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x818]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x814]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x828], ecx
cmp dword [ebp + 8], 0
je 0x403ad5
cmp dword [ebp + 0xc], 0
jne 0x403adc
xor eax, eax
jmp 0x403c2f
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push 0x4134dc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403b15
xor eax, eax
jmp 0x403c2f
mov dword [ebp - 4], 0
xor edx, edx
mov word [ebp - 0x818], dx
push 0x7fe
push 0
lea eax, [ebp - 0x816]
push eax
call fcn.00405360
add esp, 0xc
mov dword [ebp - 0xc], 0x800
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x413504
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403c20
cmp dword [ebp - 4], 1
jne 0x403c20
mov dword [ebp - 0x824], 0
lea edx, [ebp - 0x824]
push edx
push 0x413510
lea eax, [ebp - 0x818]
push eax
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x820], 0
jmp 0x403bba
mov ecx, dword [ebp - 0x820]
add ecx, 1
mov dword [ebp - 0x820], ecx
cmp dword [ebp - 0x820], 2
jge 0x403c03
cmp dword [ebp - 0x81c], 0
je 0x403c03
mov edx, dword [ebp - 0x81c]
push edx
call fcn.004049f2
add esp, 4
mov ecx, dword [ebp - 0x820]
mov dword [ebp + ecx*4 - 0x14], eax
lea edx, [ebp - 0x824]
push edx
push 0x413514
push 0
call fcn.004043a6
add esp, 0xc
mov dword [ebp - 0x81c], eax
jmp 0x403bab
cmp dword [ebp - 0x820], 2
jge 0x403c10
xor eax, eax
jmp 0x403c2f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret 8
Function at 0x403c40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x403c79
xor eax, eax
jmp 0x403d18
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00405360
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x403cc9
xor eax, eax
jmp 0x403d18
push 0x413518
lea eax, [ebp - 0x214]
push eax
call fcn.0040463f
add esp, 8
test eax, eax
jne 0x403ced
mov dword [ebp - 0x23c], 1
jmp 0x403d05
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x403cc9
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x4c], ecx
xor eax, eax
mov word [ebp - 0x18], ax
xor ecx, ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov word [ebp - 0x48], ax
xor ecx, ecx
mov dword [ebp - 0x46], ecx
mov dword [ebp - 0x42], ecx
mov dword [ebp - 0x3e], ecx
mov dword [ebp - 0x3a], ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov word [ebp - 0x22], cx
movzx edx, word [ebp - 0xc]
push edx
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x10]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
push str._04u__02u__02u__02u:_02u:_02u
push 0x14
lea edx, [ebp - 0x48]
push edx
call fcn.00404217
add esp, 0x24
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x413570
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403df3
xor eax, eax
jmp 0x403e5e
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
add edx, 2
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x50]
mov cx, word [eax]
mov word [ebp - 0x56], cx
add dword [ebp - 0x50], 2
cmp word [ebp - 0x56], 0
jne 0x403e02
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x54]
sar edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push 0x4135a4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret

Function at 0x403e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4135c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403eb2
xor eax, eax
jmp 0x403ee2
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push 0x4135f4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x40418f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41501c]
jne 0x404199
repz ret
jmp fcn.00404c83

Function at 0x40dcec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406265
and dword [ebp - 0x14], 0
cmp dword [0x416eac], 0
mov dword [ebp - 0x18], eax
jne 0x40dd9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40de47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40de47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x416eac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x416eb0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x416eb4], eax
call edi
push eax
call esi
mov dword [0x416ebc], eax
test eax, eax
je 0x40dd9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x416eb8], eax
mov eax, dword [0x416eb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ddf8
cmp dword [0x416ebc], ecx
je 0x40ddf8
push eax
call esi
push dword [0x416ebc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ddf8
test ebx, ebx
je 0x40ddf8
call edi
test eax, eax
je 0x40ddef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ddef
test byte [ebp - 8], 1
jne 0x40ddf8
or dword [ebp + 0x10], 0x200000
jmp 0x40de2b
mov eax, dword [0x416eb0]
cmp eax, dword [ebp - 0x18]
je 0x40de2b
push eax
call esi
test eax, eax
je 0x40de2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40de2b
mov eax, dword [0x416eb4]
cmp eax, dword [ebp - 0x18]
je 0x40de2b
push eax
call esi
test eax, eax
je 0x40de2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416eac]
call esi
test eax, eax
je 0x40de47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40de49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040418f
leave
ret
Function at 0x403750
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
pop ebp
ret
Function at 0x404fcc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4099dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x30], 0x43
mov byte [ebp - 0x2f], 0x33
mov byte [ebp - 0x2e], 0x34
mov byte [ebp - 0x2d], 0x39
mov byte [ebp - 0x2c], 0x37
mov byte [ebp - 0x2b], 0x43
mov byte [ebp - 0x2a], 0x36
mov byte [ebp - 0x29], 0x31
mov byte [ebp - 0x28], 0x2d
mov byte [ebp - 0x27], 0x42
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x35
mov byte [ebp - 0x24], 0x39
mov byte [ebp - 0x23], 0x2d
mov byte [ebp - 0x22], 0x34
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x20], 0x38
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x2d
mov byte [ebp - 0x1d], 0x38
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x37
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x2d
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x15], 0x37
mov byte [ebp - 0x14], 0x37
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x33
mov byte [ebp - 0xe], 0x37
mov byte [ebp - 0xd], 0x46
mov byte [ebp - 0xc], 0
mov dword [ebp - 8], 0x10c24
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x1c4], 0
je 0x409aaf
mov ecx, dword [ebp - 0x34]
cmp dword [ecx + 0x1c8], 0
je 0x409aaf
mov dword [ebp - 4], 1
jmp 0x409b2c
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [0x44c074]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x1c4], eax
mov edx, dword [ebp - 0x34]
cmp dword [edx + 0x1c4], 0
jne 0x409adc
jmp 0x409b2a
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x1c4]
push ecx
call dword [0x44c078]
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x1c8], eax
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x1c8], 0
jne 0x409b0b
jmp 0x409b28
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0x1c8]
push eax
call fcn.0043f358
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x409b2e
jmp 0x409b23
jmp 0x409b23
jmp 0x409b23
mov esp, ebp
pop ebp
ret