joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x191c3f7f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x346302d6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x425340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x436be0
lea eax, [ebp - 0x268]
call fcn.0040a230
xor eax, eax
push fcn.00425320
push ebp
push 0x40f960
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x425383
mov eax, 0x43a2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x4253cb
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x42539f
clc
jmp 0x4253a6
bt dword [0x436260], eax
jb 0x4253bf
mov eax, ebp
call fcn.00425470
test al, al
je 0x4253bf
mov byte [ebp - 0x26c], 1
jmp 0x425450
mov byte [ebp - 0x26c], 0
jmp 0x425450
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x42f5a0]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x425450
and esi, 0x400
je 0x425450
lea ebx, [ebp - 0x268]
mov edx, 0x436be0
mov eax, ebx
call fcn.0040a2f0
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00424fe0
test eax, eax
je 0x425424
sub eax, 1
je 0x42543c
jmp 0x425448
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00425340
mov byte [ebp - 0x26c], al
jmp 0x425450
mov byte [ebp - 0x26c], 1
jmp 0x425450
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00425320
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4256e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004256d0
push ebp
push 0x40f960
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x425750
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00407d30
cmp ebx, 1
jle 0x425740
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.00407650
jmp 0x42575b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405a20
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004256d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4258f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004258e0
push ebp
push 0x40f960
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x43b94c]
xor edx, edx
call fcn.00405a20
mov dword [ebx*4 + 0x43b96c], 0xffffffff
cmp ebx, 7
jl 0x425918
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4259a4
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00406410
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.0041fb00
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x4259a4
push 4
push ebx
push esi
mov eax, 0x4257c0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x425850
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004258e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425fe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x43b9b0], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x43b810], eax
mov eax, dword [ebp - 0x90]
mov dword [0x43b820], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x43b830], eax
mov eax, dword [ebp - 0x88]
mov dword [0x43b840], eax
mov edx, 0x43b851
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402000
lea eax, [ebp - 0x80]
call fcn.00402b60
mov byte [0x43b850], al
mov eax, 0x4362d8
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x43b9c0], eax
test eax, eax
je 0x426080
mov eax, 0x4362e4
push eax
push dword [0x43b9c0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x43b9b0], eax
nop
cmp dword [0x43b820], 6
jae 0x426094
mov dword [0x42ee70], 0
nop
cmp dword [0x43b820], 6
jb 0x4260b0
cmp dword [0x43b830], 1
jb 0x4260b0
mov dword [0x42ee80], 2
mov esp, ebp
pop ebp
ret
Function at 0x1001db3
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1008044]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x114], 0x104
je 0x1001e8c
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push ebx
push 0x1001208
push 0x80000002
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001e78
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x1001207
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001e78
cmp dword [ebp - 0x110], 2
lea eax, [ebp - 0x108]
jne 0x1001e5b
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x114], eax
jmp 0x1001e78
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001e78
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x10c], ebx
je 0x1001e8c
push dword [ebp - 0x10c]
call dword [entry0]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100392b
leave
ret 8

Function at 0x10023bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1001248
push 0x80000002
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002423
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x100123c
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002423
cmp dword [ebp - 8], 4
jne 0x1002423
cmp dword [ebp - 0xc], esi
jne 0x1002423
inc ebx
cmp dword [ebp - 4], esi
je 0x1002431
push dword [ebp - 4]
call dword [entry0]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40a8f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40a900
pop dword [ebp - 0x34]
mov eax, 0x9c5d874b
sub eax, 0x9c1cde4b
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x516e9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xb8961548
sub ecx, 0xb895c911
xor ebx, ebx
add ebx, eax
mov esi, 0xc4ca64b8
add esi, 0x3b7e1948
add esi, dword [ebp - 0x34]
mov edi, 0xf8b92c25
xor dword [ebp - 0x18], eax
mov edx, dword [esi]
mov dword [ebp - 0x30], 0xb98184f1
xor edx, edi
sub dword [ebp - 0x20], 0x7b5947bf
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x40a956
add eax, 0x123af
xor ebx, ebx
add ebx, eax
add eax, 0xb05fa160
add eax, 0x4fa05ea5
mov ecx, 0xb23807b3
sub ecx, 0xb1f807b3
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2800
call fcn.00403120
mov al, byte [0x405838]
push ebx
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x2810]
lea ecx, [esp + 0x2814]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0x10]
push edx
push eax
call sub.MSVCRT.dll_vsprintf
mov edi, 0x405010
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x482864]
lea ecx, [esp + 0xc]
push ecx
push 0x3f1
push edx
call fcn.004010a0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x2800
ret
Function at 0x401d50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov al, 2
push esi
push edi
xor ebx, ebx
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x120]
push ebx
stosb byte es:[edi], al
xor eax, eax
push 0x80
mov dword [esp + 0x28], eax
push 3
mov dword [esp + 0x30], eax
push ebx
push 3
mov dword [esp + 0x3c], eax
push 0xc0000000
push ecx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0x30
mov byte [esp + 0x30], 3
mov byte [esp + 0x31], 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401de2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
lea edx, [esp + 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], 0x2580
push eax
push esi
mov byte [esp + 0x52], 8
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
lea ecx, [esp + 0x1c]
mov eax, 5
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebp
lea edx, [esp + 0x34]
push ebx
push edx
lea eax, [esp + 0x18]
push 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401e6d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
xor edi, edi
lea ecx, [esp + 0x18]
push ebx
push ecx
lea edx, [esp + 0x5c]
push 0xc8
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], ebx
jne 0x401e9c
push 0xa
call ebp
inc edi
cmp edi, 3
jb 0x401e6f
mov edi, dword [esp + 0x30]
jmp 0x401eb3
lea eax, [esp + 0x54]
push eax
push str.Device_Info:__s
call fcn.00401000
add esp, 8
mov edi, 1
cmp dword [esp + 0x18], ebx
jne 0x401ec6
push str.Fail_to_get_DeviceInfo_
call fcn.00401000
add esp, 4
lea ecx, [esp + 0x38]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea edx, [esp + 0x38]
mov dword [esp + 0x3c], 0xe100
push edx
push esi
mov byte [esp + 0x52], 8
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x401260
Capabilities:
Hide graphical window

Disassembly:
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x403100], eax
push esp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4030f4], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x40128d
push esp
mov dword [ebp - 0x24], 0x401330
mov eax, dword [0x4030f4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.wookernof
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4030f4]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.tofkol
push str.wookernof
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403104], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40132c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40130d
pop ebp
ret 0x10

Function at 0x401ae8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebx, section..text
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
sub ebx, 0x1000
mov dword [0x4028f4], ebx
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401b11
push esp
mov eax, str.contents
mov dword [ebp - 4], eax
lea eax, [0x401187]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4028f4]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x4028f4]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402904], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402904]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401bc9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401bb0
pop ebp
ret 0x10
Function at 0x409be0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x468eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045d9c1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409c62
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045b740
mov eax, dword [eax]
push 0x4811f0
push eax
call fcn.0044e334
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045dc4c
test bl, bl
je 0x409c62
push 0x4811f0
lea ecx, [esp + 0xc]
call fcn.0045dfdc
push 0x484d6c
lea ecx, [esp + 0xc]
call fcn.0045dfdc
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409c9e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045dc4c
jmp 0x409d69
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409d22
lea edx, [esp + 0x7c]
push 0x484d68
push edx
call fcn.0044e334
add esp, 8
test eax, eax
je 0x409d22
lea eax, [esp + 0x7c]
push 0x484d64
push eax
call fcn.0044e334
add esp, 8
test eax, eax
je 0x409d22
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409cb2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045dc4c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a560
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a5c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc