joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b67c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b34
mov eax, dword [ebp - 8]
call fcn.00403b34
xor eax, eax
push ebp
push 0x40b71b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403b44
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jbe 0x40b6fb
push 4
mov eax, dword [ebp - 8]
call fcn.00403b44
push eax
push ebx
call sub.advapi32.dll_RegCloseKey
mov edi, eax
test edi, edi
jbe 0x40b6f1
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40b6eb
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_RegOpenKeyA
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov ebx, esi
jmp 0x40b700
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b722
lea eax, [ebp - 8]
mov edx, 2
call fcn.004036cc
ret

Function at 0x40b7e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.00403b44
push eax
call sub.KERNEL32.DLL_SizeofResource
cmp eax, 0xffffffff
je 0x40b839
push eax
call sub.KERNEL32.DLL_SetFileTime
test byte [ebp - 0x14c], 0x10
jne 0x40b839
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x40b840
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40be9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
add esp, 0xfffffff8
mov dword [esp], edx
xor edx, edx
test ecx, ecx
je 0x40bec6
push 0
lea edx, [esp + 8]
push edx
push 4
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0x22e14b
push eax
call sub.KERNEL32.DLL_LockResource
mov edx, eax
mov eax, edx
pop ecx
pop edx
ret
Function at 0x40becc
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, dword [ebp - 0x14]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetThreadLocale
mov ebx, eax
test ebx, ebx
je 0x40c024
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40c024
lea eax, [ebx + 0x20]
movzx edx, word [ebx + 0x1e]
add eax, edx
push 1
push 0
push eax
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40c024
xor edx, edx
push ebp
push 0x40c016
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
call sub.KERNEL32.DLL_LoadLibraryExA
push 0x40c030
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary
mov ecx, eax
sub ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, edi
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 4
adc edx, 0
add eax, 0x14
adc edx, 0
mov dword [ebp - 0x18], eax
mov eax, edi
mov edx, ecx
mov ecx, esi
call fcn.0040bdb8
test eax, eax
mov ebx, dword [ebp - 0xc]
add ebx, eax
test ebx, ebx
jne 0x40bfc4
call fcn.004031b4
jmp 0x40c024
xor edi, edi
mov esi, 0x11c
mov eax, dword [ebx]
mov edx, dword [ebp - 0x18]
sub eax, dword [edx + 0x1c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0040be9c
test eax, eax
jne 0x40bff1
call fcn.004031b4
jmp 0x40c024
add ebx, 4
inc edi
dec esi
jne 0x40bfcb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c01d
push 0x64
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL__lclose
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c04c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b34
xor eax, eax
push ebp
push 0x40c15a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x40c16c
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov esi, eax
push 0xf003f
push ebx
push esi
call sub.advapi32.dll_RegCloseKey
mov ebx, eax
test ebx, ebx
jne 0x40c0a0
push esi
call sub.KERNEL32.DLL_GetStringTypeExA
jmp 0x40c144
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call sub.advapi32.dll_RegRestoreKeyA
push 0x80
mov eax, dword [0x40f874]
call fcn.00403b44
push eax
call sub.KERNEL32.DLL_LocalAlloc
mov eax, dword [ebp - 4]
call fcn.0040b9dc
lea eax, [ebp - 8]
push eax
push 0
push ebx
call sub.advapi32.dll_RegQueryValueExA
lea eax, [ebp - 8]
push eax
push 0
push ebx
call sub.advapi32.dll_RegQueryValueExA
push ebx
call sub.advapi32.dll_RegOpenKeyA
push esi
call sub.advapi32.dll_RegOpenKeyA
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push 0x40c174
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c12f
mov eax, dword [ebp - 4]
call fcn.0040b7c8
push pe_nt_image_headers32
push 0x40c180
push 0x40c18c
push 0
call sub.user32.dll_MessageBoxA
jmp 0x40c144
mov eax, ebx
call fcn.0040becc
mov eax, dword [ebp - 4]
call fcn.0040b7c8
push ebx
call sub.KERNEL32.DLL_GetStringTypeExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c161
lea eax, [ebp - 4]
call fcn.004036a8
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00402767
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00402767
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00402767
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00402767
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00402767
mov dword [0x41203c], eax
call fcn.00402767
test eax, eax
jge 0x402550
push 8
call fcn.00402767
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00402767
pop ecx
push 1
call fcn.00402767
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00402767
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00402767
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00402767
jmp 0x402495

Function at 0x402767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402776
pop dword [ebp - 0x28]
mov eax, 0x9ffb7c2
add eax, 0xf6406fb4
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3578e
push 0
mov eax, 0xfb936054
add eax, 0x4ad8084
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xcbf19218
sub ecx, 0xcbf15b7b
mov ebx, eax
mov edi, 0x3889260d
add edi, 0xc7b815b7
add edi, dword [ebp - 0x28]
mov edx, 0x3913937e
xor dword [ebp - 0xc], ebx
mov esi, dword [edi]
add esi, edx
sub dword [ebp - 4], 0xb1bb0b8
mov dword [ebx], esi
add dword [ebp - 0x10], eax
add ebx, 0x499a8677
add ebx, 0xb665798d
add edi, 0x1296898c
add edi, 0xed697678
loop 0x4027cf
add eax, 0x5dd21f34
add eax, 0xa22eae13
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5693e824
sub ecx, 0x5653e824
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x406a10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00406c70
call fcn.00406c00
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x406a48
jmp 0x406ae6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x406a47
cmp cl, 0x22
je 0x406aa0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x406ac0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x406a80
jmp 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x406aa0
cmp cl, 0x22
je 0x406b22
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x406ae0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x406ad0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x406b04
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004013b0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x406ac0

Function at 0x40a5b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40a5c2
pop dword [ebp - 0x4c]
mov eax, 0x40a5c2
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xd3922507
add dword [ebp - 0x5c], 0x7ac02044
mov dword [ebp - 0x58], 0xe28e5ebc
sub dword [ebp - 0x58], 0xb05b1277
mov dword [ebp - 0x54], 0x7a742dd1
add dword [ebp - 0x54], 0xd1d8165d
mov dword [ebp - 0x50], 0x4fdfd662
add dword [ebp - 0x50], 0xb020299e
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x7696ab1b
add eax, 0x89af0549
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xae109d9f
add dword [ebp - 0x5c], 0xc661cbb7
mov dword [ebp - 0x58], 0x83730afd
sub dword [ebp - 0x58], 0x4206a988
mov dword [ebp - 0x54], 0x818ae6ee
add dword [ebp - 0x54], 0xe1e4857e
mov dword [ebp - 0x50], 0x5a8da9ed
add dword [ebp - 0x50], 0xa5725613
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x6bbb0ccc
sub eax, 0x6b755c4c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x49533
push 0
call eax
mov ecx, 0x4a901342
sub ecx, 0x4a8fde0f
xor edx, edx
add edx, eax
mov ebx, 0x476000
add ebx, dword [ebp - 0x4c]
mov esi, 0x42728d53
add esi, 0xdc4aed42
sub dword [ebp - 0x48], 0xeee2bd41
mov edi, dword [ebx]
xor dword [ebp - 0x20], 0x4aab191f
add edi, esi
xor dword [ebp - 0x38], edi
mov dword [edx], edi
add dword [ebp - 0x2c], esi
add edx, 4
add ebx, 0x23b14818
add ebx, 0xdc4eb7ec
loop 0x40a6db
add eax, 0xa38989db
add eax, 0x5c773dc4
xor ebx, ebx
add ebx, eax
add eax, 0xb6d63e3f
sub eax, 0xb6d63e3a
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4030ca
pop dword [ebp - 0x28]
mov eax, 0x1a18c0a0
add eax, 0xe627702a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xcf0bea1f
add dword [ebp - 0x38], 0x7f465b2c
mov dword [ebp - 0x34], 0x27e1da3
add dword [ebp - 0x34], 0x2fb52ea2
mov dword [ebp - 0x30], 0x432a5e79
sub dword [ebp - 0x30], 0xf6de1a4b
mov dword [ebp - 0x2c], 0xe78aad16
add dword [ebp - 0x2c], 0x187552ea
lea eax, [ebp - 0x38]
push eax
mov eax, 0x9f92bd2
add eax, 0xf6475532
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc8dabe4b
add dword [ebp - 0x38], 0xab97ab0b
mov dword [ebp - 0x34], 0x8e846926
add dword [ebp - 0x34], 0xb2e7f84f
mov dword [ebp - 0x30], 0xa45ef2f4
add dword [ebp - 0x30], 0xbf107978
mov dword [ebp - 0x2c], 0x906936da
add dword [ebp - 0x2c], 0x6f96c926
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x1b848e48
add eax, 0xe4bbf2b8
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x324e4
push 0
call eax
mov ecx, 0x64810fab
add ecx, 0x9b7f259b
xor edx, edx
add edx, eax
mov esi, 0x96bebdb5
sub esi, 0x9679b9b5
add esi, dword [ebp - 0x28]
mov ebx, 0x2d325828
xor dword [ebp - 0x20], ecx
mov edi, dword [esi]
xor dword [ebp - 0x14], 0x4bf89fc4
sub edi, ebx
xor dword [ebp - 0x10], ebx
mov dword [edx], edi
add edx, 4
add esi, 0xf1e758a7
sub esi, 0xf1e758a3
loop 0x4031e8
add eax, 0xc7eb
mov ebx, eax
add eax, 0x26b28809
sub eax, 0x26b28804
mov ecx, 0xd7bb31db
add ecx, 0x2884ce25
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40170c
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push eax
call dword [sym.imp.COMCTL32.DLL_InitCommonControls]
push 0
push 0x401673
push 0
push 0x3e8
push 0x400000
mov ecx, 0x186a0
jmp 0x401736
dec ecx
or ecx, ecx
jne 0x401735
call dword [sym.imp.USER32.DLL_DialogBoxParamA]
pop eax
cmp dword [0x40c029], 0
jne 0x402ade
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
dec edi
inc ebx
add ebx, eax
dec eax
push 0
push 0
push 0
push 0x40c015
push 0
push sym.imp.USER32.DLL_BroadcastSystemMessageW
dec edx
inc eax
add edi, 0x79666a
inc ecx
dec edi
pop eax
add ebx, eax
sub esi, 0x79734669
dec esi
add esi, edi
add ebx, 0x506e524d
sub esi, 0x31473872
call dword [eax]
push 0x402b1f
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40642a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406439
pop dword [ebp - 0x2c]
mov eax, 0x406439
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1e8dcd17
add dword [ebp - 0x3c], 0x2fc47834
mov dword [ebp - 0x38], 0x5f44c9a7
add dword [ebp - 0x38], 0xd2ee829e
mov dword [ebp - 0x34], 0x3746f15
add dword [ebp - 0x34], 0x48d7d519
mov dword [ebp - 0x30], 0x194e1ea2
add dword [ebp - 0x30], 0xe6b1e15e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x2e37921a
sub eax, 0x2df6c1ce
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc961eab5
add dword [ebp - 0x3c], 0xab107ea1
mov dword [ebp - 0x38], 0xd313b2d1
add dword [ebp - 0x38], 0x6e58aea4
mov dword [ebp - 0x34], 0xc1e5b5a8
sub dword [ebp - 0x34], 0x5e76493c
mov dword [ebp - 0x30], 0xf2acfac8
add dword [ebp - 0x30], 0xd530538
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xdaf14953
add eax, 0x254f86f5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e0f
push 0
call eax
mov ecx, 0x9df6eb86
sub ecx, 0x9df6a60c
mov edx, eax
mov edi, 0x78e7f1dc
add edi, 0x8759be24
add edi, dword [ebp - 0x2c]
mov esi, 0xce57c6fd
sub esi, 0xfbcf6e50
xor dword [ebp - 0x1c], 0xdd766bfd
mov ebx, dword [edi]
add ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0xc], ecx
add edx, 0xbb7fd10a
add edx, 0x44802efa
add edi, 0x68d30202
sub edi, 0x68d301fe
loop 0x406556
add eax, 0x7f870f1b
add eax, 0x8079f9a0
xor ebx, ebx
add ebx, eax
add eax, 0x8aaf2226
sub eax, 0x8aaf2221
mov ecx, 0x59a154cf
sub ecx, 0x596154cf
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4076a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push 0x438c3a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x444690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
pop esi
mov dword [ebp - 0x10], esi
push 0
call fcn.0041f008
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
sub eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x407742
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], 0x440d40
call fcn.004208ab
push 0x4420b8
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x43a2c4
call fcn.00422a9b
push eax
push esi
call fcn.0041f29f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408280
Capabilities:
Set registry value

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push 0x438d6b
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x444690]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x30], ecx
sub edi, edi
mov edx, 0x445c50
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.0040ad40
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], edi
je 0x4083e1
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
push ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040a930
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x4083d3
test esi, esi
je 0x4083de
sub esp, 8
lea ecx, [ebp - 0xf0]
call fcn.004089f0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 3
call fcn.0040a2f0
push ebx
pop edx
push eax
pop ecx
call fcn.0040a5b0
mov ecx, eax
call fcn.0040a2f0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00408b20
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
lea edx, [ebp - 0x2c]
cmp edi, 8
cmovae edx, ebx
lea ecx, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x408350
sub edx, ecx
sar edx, 1
lea ecx, [ebp - 0x2c]
lea eax, [edx*2 + 2]
push eax
cmp edi, 8
cmovae ecx, ebx
push ecx
push 2
push 0
push dword [ebp - 0x30]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp - 0x18], 8
jb 0x408397
push dword [ebp - 0x2c]
call fcn.0041fd2d
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 2
call fcn.00408aa0
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x440f0c
call fcn.0041f8a1
add esp, 4
test esi, esi
je 0x4083de
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
or ecx, ecx
jg 0x408411
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.wtsapi32.dll_WTSVirtualChannelOpen]
jmp 0x408411
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fd32
mov esp, ebp
pop ebp
ret
Function at 0x40a9c0
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x670
mov eax, dword [0x444690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x440f18
push 0x440c88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x440f28
push 0x440f34
push eax
pop edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
mov esi, eax
test edi, edi
je 0x40ab08
test esi, esi
je 0x40ab08
push reloc.wtsapi32.dll_WTSVirtualChannelPurgeInput
lea eax, [ebp - 0x66c]
push 0
push eax
call fcn.00422330
sub eax, eax
push 0x206
push eax
mov word [ebp - reloc.wtsapi32.dll_WTSSetSessionInformationW], ax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x620], eax
mov word [ebp - reloc.wtsapi32.dll_WTSSetSessionInformationW], ax
lea eax, [ebp - 0x20a]
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x670], 0x44
movq qword [ebp - 0x628], xmm0
call fcn.00422330
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x440f4c
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
sub eax, eax
push 0x40e
push eax
mov word [ebp - reloc.wtsapi32.dll_WTSSetSessionInformationW], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.00422330
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x440f54
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.00420b3c
add esp, 0x20
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fd32
push ebp
pop esp
pop ebp
ret