joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002523
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x10002533
push 3
pop eax
jmp 0x1000257b
cmp byte [eax + 3], bl
jbe 0x1000253c
push 8
jmp 0x10002530
push esi
push 8
mov dword [0x10010ce4], eax
call fcn.10003243
pop ecx
cmp eax, ebx
je 0x10002557
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov esi, eax
jmp 0x10002559
xor esi, esi
mov dword [0x10010ce8], esi
cmp esi, ebx
je 0x10002578
push ebx
push ebx
push esi
push 0x1000168c
push ebx
push ebx
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x1000257f
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x10010ce8]
test eax, eax
je 0x100025a9
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10010ce8]
test eax, eax
je 0x100025a9
push eax
call fcn.10003023
and dword [0x10010ce8], 0
pop ecx
xor eax, eax
ret

Function at 0x100025b2
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x100025e1
xor al, al
jmp 0x10002668
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.10007ef0
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.10003147
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.100011de
pop ecx
pop ecx
mov edi, eax
call esi
test edi, edi
je 0x10002637
xor al, al
jmp 0x10002666
mov ecx, dword [ebp - 0x80]
call fcn.10002ea1
inc eax
push eax
push ecx
push 1
push 0
push str.sc1u
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.10003014
add ebp, 0x94
leave
ret
Function at 0x1000267d
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x100026ac
xor al, al
jmp 0x1000272f
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.10007ef0
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.10003147
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.100011de
pop ecx
pop ecx
mov edi, eax
call esi
test edi, edi
je 0x10002702
xor al, al
jmp 0x1000272d
push 4
lea eax, [ebp + 0xa0]
push eax
push 4
push 0
push dword [ebp - 0x80]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.10003014
add ebp, 0x94
leave
ret

Function at 0x10002744
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x80], eax
test ebx, ebx
jne 0x10002773
xor al, al
jmp 0x100027f9
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.10007ef0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
call esi
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.10003147
add esp, 0x14
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.100011de
pop ecx
pop ecx
mov edi, eax
call esi
test edi, edi
je 0x100027ce
xor al, al
jmp 0x100027f7
push dword [ebp + 0xa0]
push dword [ebp - 0x80]
push 3
push 0
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.10003014
add ebp, 0x94
leave
ret
Function at 0x1000280e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push esi
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xa8]
mov esi, 0x104
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6f]
push 0
push eax
mov dword [ebp - 0x7c], 1
mov byte [ebp - 0x70], 0
call fcn.10007ef0
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.10003147
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
call esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, eax
call esi
test edi, edi
je 0x1000289c
xor al, al
jmp 0x100028c8
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push dword [ebp - 0x78]
push eax
push 0
push str.sc1u
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
mov ecx, dword [ebp + 0x98]
pop edi
xor ecx, ebp
pop esi
call fcn.10003014
add ebp, 0x9c
leave
ret

Function at 0x100028df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push 4
mov dword [ebp - 0x7c], eax
pop eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
test edi, edi
jne 0x10002917
xor al, al
jmp 0x1000299d
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x6b]
push 0
push eax
mov byte [ebp - 0x6c], 0
call fcn.10007ef0
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.10003147
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
call esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x80], eax
call esi
cmp dword [ebp - 0x80], 0
je 0x10002973
xor al, al
jmp 0x1000299c
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
push 0
push edi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x70]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.10003014
add ebp, 0xa0
leave
ret
Function at 0x100029b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xa8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], 3
test ebx, ebx
jne 0x100029f1
xor al, al
jmp 0x10002a77
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call esi
mov edi, 0x104
push edi
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.10007ef0
push 0x1000ff50
push str.AppDataLow
push str.Software_s_s
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.10003147
add esp, 0x20
call esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, eax
call esi
test edi, edi
je 0x10002a4d
xor al, al
jmp 0x10002a75
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push dword [ebp - 0x78]
push eax
push 0
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
call fcn.10003014
add ebp, 0x9c
leave
ret
Function at 0x10002bb0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete registry value
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x938
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov esi, 0x104
push esi
mov dword [ebp - 0x930], eax
lea eax, [ebp - 0x123]
push ebx
push eax
mov dword [ebp - 0x92c], ebx
mov byte [ebp - 0x925], bl
mov byte [ebp - 0x124], bl
call fcn.10007ef0
push 0x1000ff50
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push str._s_s_s
lea eax, [ebp - 0x124]
push esi
push eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], bl
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], bl
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x24
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x124]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002d66
push 0x7ff
lea eax, [ebp - 0x923]
push ebx
push eax
mov dword [ebp - 0x938], 0x800
mov dword [ebp - 0x934], 1
mov byte [ebp - 0x924], bl
call fcn.10007ef0
add esp, 0xc
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x934]
push eax
push ebx
mov esi, str.typnc
push esi
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10002d5a
push edi
lea eax, [ebp - 0x924]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
jle 0x10002d03
xor byte [ebp + edi - 0x924], 0x5f
inc edi
cmp edi, eax
jl 0x10002cf6
pop edi
lea eax, [ebp - 0x924]
cmp dword [ebp - 0x930], ebx
jne 0x10002d2a
push 9
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jb 0x10002d53
jmp 0x10002d37
push eax
push dword [ebp - 0x930]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push dword [ebp - 0x92c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call esi
push str.mwfffp
push dword [ebp - 0x92c]
call esi
mov byte [ebp - 0x925], 1
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x92c], ebx
pop esi
pop ebx
je 0x10002d7c
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x925]
xor ecx, ebp
call fcn.10003014
leave
ret

Function at 0x10003014
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f060]
jne 0x1000301e
repz ret
jmp fcn.100035be
Function at 0x1000b1f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100041f9
and dword [ebp - 4], 0
cmp dword [0x10010c08], 0
mov ebx, eax
jne 0x1000b2a9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000b35a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000b35a
push eax
call fcn.10004187
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10010c08], eax
call esi
push eax
call fcn.10004187
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10010c0c], eax
call esi
push eax
call fcn.10004187
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10010c10], eax
call esi
push eax
call fcn.10004187
pop ecx
mov dword [0x10010c18], eax
test eax, eax
je 0x1000b2a9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004187
pop ecx
mov dword [0x10010c14], eax
mov eax, dword [0x10010c14]
cmp eax, ebx
je 0x1000b301
cmp dword [0x10010c18], ebx
je 0x1000b301
push eax
call fcn.10004202
push dword [0x10010c18]
mov esi, eax
call fcn.10004202
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000b301
test edi, edi
je 0x1000b301
call esi
test eax, eax
je 0x1000b2f8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000b2f8
test byte [ebp - 0xc], 1
jne 0x1000b301
or dword [ebp + 0x10], 0x200000
jmp 0x1000b33a
mov eax, dword [0x10010c0c]
cmp eax, ebx
je 0x1000b33a
push eax
call fcn.10004202
pop ecx
test eax, eax
je 0x1000b33a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000b33a
mov eax, dword [0x10010c10]
cmp eax, ebx
je 0x1000b33a
push eax
call fcn.10004202
pop ecx
test eax, eax
je 0x1000b33a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10010c08]
call fcn.10004202
pop ecx
test eax, eax
je 0x1000b35a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000b35c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4032d0
push ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4011c5
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cdq
push esi
mov ebx, eax
mov dword [ebp + 8], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov ecx, ebx
add esp, 0x14
or ecx, dword [ebp + 8]
jne 0x401199
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
push esi
push ebx
push 1
push eax
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [edi], ebx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40149f
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x24c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.00408246
sub esp, 0x10
test eax, eax
jne 0x401608
test byte [ebp + 0x10], 2
je 0x401565
lea eax, [ebp - 0x228]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
je 0x401565
jmp 0x4015a7
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0040149f
sub esp, 0xc
test eax, eax
jne 0x4015be
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x222]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x4015be
mov eax, dword [ebp - 0x22c]
test byte [ebp + 0x10], 1
je 0x40154b
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x401608
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.004087bd
push edx
test eax, eax
jne 0x4015f0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
jmp 0x401608
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x403d4b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42a880]
cmp dword [ebp + 8], 0
je 0x403d76
test eax, eax
je 0x403d6a
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x42a880], 0
jmp 0x403de0
test eax, eax
je 0x403d89
mov dword [esp], 0
call fcn.00409085
push edx
jmp 0x403de0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x43c2e0]
jbe 0x403de0
mov eax, dword [0x43c30c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403c90
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
sub esp, 0x14
mov dword [0x42a880], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret
Function at 0x407bee
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x43abc0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x43abc0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x407c6a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
leave
mov eax, edx
ret 4

Function at 0x407c70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407ee9
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407f17
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407f22
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00407ee9
push ecx
cmp eax, 0xffffffff
jne 0x407f43
xor edi, edi
jmp 0x407f80
mov esi, eax
mov dword [esp], ebx
test edi, 1
je 0x407f78
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407f71
and edi, 4
jne 0x407f3f
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407f80
mov edi, 1
jmp 0x407f80
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407f56
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x407f8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407fa7
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc