joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41df07
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x41df79
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00421ccb
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x41df7c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe84
push esi
push edi
lea eax, [ebp - 0x210]
call fcn.0040e9b1
mov eax, dword [ebp + 8]
call fcn.0040bbfb
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41dfc6
lea eax, [ebp - 0x210]
push eax
call fcn.0041d5f3
pop ecx
movzx eax, al
test eax, eax
je 0x41dfc4
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
jmp 0x41dfe8
lea eax, [ebp - 0x210]
push eax
call fcn.0041de76
pop ecx
movzx eax, al
test eax, eax
je 0x41dfe8
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
lea eax, [ebp - 0x210]
push eax
call fcn.0041debd
pop ecx
movzx eax, al
test eax, eax
je 0x41e00a
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
call fcn.0041df07
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x41e044
push dword [ebp - 0x214]
push 0x4388b4
lea eax, [ebp - 0x210]
call fcn.004017c3
pop ecx
pop ecx
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
mov eax, dword [ebp + 8]
call fcn.0040adbe
movzx eax, al
test eax, eax
jne 0x41e063
lea eax, [ebp - 0x210]
call fcn.0040e9a2
jmp 0x41e109
and dword [ebp - 0x238], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
movzx eax, word [ebp - 0x218]
test eax, eax
je 0x41e0d8
movzx eax, word [ebp - 0x216]
test eax, eax
je 0x41e0d8
movzx eax, word [ebp - 0x216]
push eax
movzx eax, word [ebp - 0x218]
push eax
push str._u._u
lea eax, [ebp - 0x210]
call fcn.004017c3
add esp, 0xc
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
lea eax, [ebp - 0x210]
call fcn.0040e9a2
jmp 0x41e109
call fcn.004197b3
push eax
push 0x4388b4
lea eax, [ebp - 0x210]
call fcn.004017c3
pop ecx
pop ecx
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041e321
lea eax, [ebp - 0x210]
call fcn.0040e9a2
pop edi
pop esi
leave
ret
Function at 0x41e361
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [ebp - 0x11c]
push 0
push eax
mov esi, ecx
call fcn.00423fe0
add esp, 0xc
lea eax, [ebp - 0x330]
call fcn.0040e9b1
mov eax, dword [esi + 4]
and dword [esi + 8], 0
test eax, eax
je 0x41e3a2
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call ebx
test eax, eax
jne 0x41e3dd
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call ebx
test eax, eax
jne 0x41e3dd
xor al, al
jmp 0x41e518
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
test edi, edi
je 0x41e3f6
mov eax, ecx
imul eax, eax, 0x64
add eax, edx
mov dword [edi], eax
mov eax, dword [ebp - 0x110]
dec eax
je 0x41e4fa
dec eax
je 0x41e410
push str.Microsoft_Win32s
jmp 0x41e511
cmp ecx, 4
ja 0x41e41c
push 0x438564
jmp 0x41e45e
cmp ecx, 5
jne 0x41e441
mov eax, edx
sub eax, 0
je 0x41e43a
dec eax
je 0x41e433
push str.Windows_2003
dec eax
jmp 0x41e45e
push 0x4385ac
jmp 0x41e45e
push str.Windows_2000
jmp 0x41e45e
cmp ecx, 6
jne 0x41e459
cmp edx, 1
jae 0x41e452
push str.Windows_Vista
jmp 0x41e45e
push str.Windows_7
jmp 0x41e45e
push str.Windows
call fcn.0040add8
cmp byte [ebp - 6], 1
jne 0x41e473
push str._Professional
call fcn.0041681a
cmp byte [ebp - 6], 3
jne 0x41e483
push str._Server
call fcn.0041681a
cmp byte [ebp - 6], 2
jne 0x41e493
push str._Domain
call fcn.0041681a
cmp word [ebp - 0x10c], 0
movzx eax, word [ebp - 0x114]
push eax
jne 0x41e4b9
push str.__Build__d_
lea eax, [ebp - 0x330]
call fcn.004017c3
pop ecx
pop ecx
jmp 0x41e4d3
lea eax, [ebp - 0x10c]
push eax
push str.__s__Build__d_
lea eax, [ebp - 0x330]
call fcn.004017c3
add esp, 0xc
lea edi, [ebp - 0x330]
call fcn.0041e321
mov eax, edi
call fcn.0041e2b6
test al, al
je 0x41e516
push str._on
call fcn.0041681a
call fcn.0041e321
jmp 0x41e516
cmp ecx, 4
ja 0x41e50c
jne 0x41e505
test edx, edx
ja 0x41e50c
push str.Microsoft_Windows_95
jmp 0x41e511
push str.Microsoft_Windows_98
call fcn.0041681a
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42041f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
xor esi, esi
cmp dword [edi + 0x86c], esi
je 0x4204df
cmp dword [edi + 0x870], 1
jl 0x4204df
push 0x88
lea eax, [ebp - 0x94]
push esi
push eax
call fcn.00423fe0
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push 0x3f
push eax
mov dword [ebp - 0x98], esi
call fcn.0040a95b
add esp, 0xc
push dword [edi + 0x864]
lea eax, [ebp - 0x98]
push eax
mov esi, edi
call fcn.00420dd5
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, edi
call fcn.004204e7
test al, al
je 0x4204df
cmp dword [edi + 0x828], 5
mov eax, str._files_mt5_cdn.txt
je 0x4204b4
mov eax, str._files_mt4_cdn.txt
push eax
lea ecx, [edi + 4]
call fcn.0041ce48
cmp eax, 0xc8
jne 0x4204df
call ebx
sub eax, dword [ebp - 4]
mov ecx, esi
lea ecx, [ecx + 0x84]
mov dword [ecx], eax
jne 0x4204db
mov dword [ecx], 1
mov al, 1
jmp 0x4204e1
xor al, al
pop esi
pop ebx
leave
ret 4
Function at 0x4207f0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
push ebx
push esi
push edi
xor edi, edi
mov ebx, eax
mov esi, ecx
cmp dword [ebp + 0x10], edi
je 0x4208d9
cmp dword [esi + 0x86c], edi
je 0x4208d9
cmp dword [esi + 0x870], 1
jl 0x4208d9
lea eax, [ebp - 0x26c]
call fcn.00406522
xor eax, eax
push 0x206
mov word [ebp - 0x474], ax
lea eax, [ebp - 0x472]
push edi
push eax
call fcn.00423fe0
add esp, 0xc
push 8
pop ecx
mov dword [ebp - 0x50], edi
xor eax, eax
lea edi, [ebp - 0x4c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x474]
push eax
xor edi, edi
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4208d9
push dword [ebp + 0x10]
lea eax, [ebp - 0x474]
push eax
push str._sMetaQuotesWebInstall_s
lea eax, [ebp - 0x26c]
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x4208d9
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
test eax, eax
je 0x4208d9
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x48]
push dword [ebp - 0x268]
cmp eax, 0x2ee
jbe 0x4208e2
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], edi
lea edi, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x435584
call fcn.004212a8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x420913
cmp dword [ebp - 8], 0xffffffff
je 0x4208d9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4208d9
mov edi, dword [ebp - 0x14]
test edi, edi
jne 0x420923
push eax
call fcn.0042209e
pop ecx
jmp 0x420902
call fcn.00420e22
push dword [ebp - 0x10]
mov eax, esi
call fcn.00420e47
push dword [ebp - 0x10]
test al, al
je 0x42091b
call fcn.0042209e
pop ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ecx + 0x8c]
add dword [eax], edi
and dword [ebx], 0
mov eax, dword [eax]
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0x88]
push ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
push 0x3f
push eax
call fcn.0040a95b
add esp, 0xc
push dword [esi + 0x868]
push ebx
call fcn.00420dd5
push 0
push dword [ebp + 0x10]
mov ebx, esi
push dword [ebp + 8]
call fcn.00420f2e
cmp dword [ebp - 8], 0xffffffff
mov bl, al
je 0x420996
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
jmp 0x4208db
Function at 0x420f2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
cmp byte [ebp + 0x10], 0
push esi
push edi
je 0x420f81
mov ecx, dword [ebx + 0x878]
cmp ecx, 0x2b1
jg 0x420f54
xor al, al
jmp 0x4210ac
mov eax, dword [ebx + 0x874]
add ecx, 0xfffffd4f
push ecx
lea ecx, [eax + 0x2b1]
push ecx
push dword [ebx + 0x87c]
push eax
call fcn.00423dc5
add esp, 0x10
add dword [ebx + 0x878], 0xfffffd4f
push dword [ebx + 0x878]
mov ecx, dword [ebx + 0x874]
call fcn.004210b2
mov byte [ebp - 5], al
test al, al
je 0x4210a9
push dword [ebx + 0x874]
mov edi, dword [ebx + 0x878]
mov esi, dword [ebp + 8]
push 5
pop eax
call fcn.0041c06f
mov byte [ebp - 5], al
test al, al
je 0x4210a9
cmp byte [ebp + 0x10], 0
je 0x4210a9
lea eax, [ebp - 0x434]
call fcn.00406522
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor esi, esi
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.00423fe0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x421011
mov al, 1
jmp 0x4210ac
lea eax, [ebp - 0x21c]
push eax
push str._sMetaQuotesWebInstall
lea eax, [ebp - 0x434]
call fcn.004017c3
lea eax, [ebp - 0x434]
call fcn.0040dea9
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
or edi, 0xffffffff
push str._sMetaQuotesWebInstall_s
lea eax, [ebp - 0x434]
mov dword [ebp - 0x10], 0x435584
mov dword [ebp - 0xc], edi
call fcn.004017c3
add esp, 0x14
push 2
push 3
push 0x40000000
push dword [ebp - 0x430]
lea eax, [ebp - 0x10]
call fcn.00401897
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
je 0x42109f
push dword [ebx + 0x878]
lea eax, [ebp - 0x10]
push dword [ebx + 0x874]
call fcn.0040a8f7
cmp dword [ebp - 0xc], edi
je 0x4210a9
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], edi
je 0x4210a9
push dword [ebp - 0xc]
call esi
mov al, byte [ebp - 5]
pop edi
pop esi
leave
ret 0xc

Function at 0x4211d4
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x421203
xor al, al
jmp 0x421284
mov eax, dword [esi + 0xc]
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProxyServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x421236
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4211fc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00406508
cmp dword [ebp - 0xc], 1
jne 0x4211fc
push 0x438eb8
call fcn.004166ec
test eax, eax
jl 0x42125f
lea edx, [eax + 1]
mov eax, esi
call fcn.00413024
push 0x438ebc
call fcn.004166ec
test eax, eax
jl 0x421282
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x421282
cmp eax, dword [esi + 8]
jae 0x421282
xor edx, edx
mov dword [esi + 8], eax
mov word [ecx + eax*2], dx
mov al, 1
pop esi
leave
ret
Function at 0x4212a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push esi
mov esi, eax
jne 0x4212c0
xor eax, eax
pop esi
leave
ret 4
push 3
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call fcn.00401897
test al, al
je 0x4212b9
push esi
call fcn.0040e9d8
mov dword [edi], eax
test eax, eax
jne 0x4212e8
call fcn.004019af
jmp 0x4212b9
push ebx
add eax, 0x10
push 0x43e6c8
push eax
call fcn.00422533
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42130b
xor ebx, ebx
call fcn.004019af
mov eax, ebx
pop ebx
jmp 0x4212bb
mov eax, dword [edi]
test eax, eax
jbe 0x421301
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x421301
push ebx
call fcn.0042209e
pop ecx
jmp 0x4212ff

Function at 0x42132f
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 8], ebx
cmp ecx, ebx
je 0x421435
cmp esi, ebx
je 0x421435
mov byte [esi], bl
cmp dword [ebp + 0xc], ebx
jbe 0x42142f
jmp 0x421362
mov ecx, dword [ebp + 8]
cmp eax, 0x3f8
jae 0x42142f
mov dl, byte [edi + ecx]
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x421383
mov byte [ebp - 2], 0
mov dword [ebp - 8], 2
jmp 0x42139f
mov bl, byte [edi + ecx]
inc edi
mov byte [ebp - 2], bl
cmp edi, dword [ebp + 0xc]
jae 0x421398
mov cl, byte [edi + ecx]
mov byte [ebp - 1], cl
inc edi
jmp 0x4213a3
mov dword [ebp - 8], 1
mov byte [ebp - 1], 0
mov cl, byte [ebp - 2]
mov bl, byte [ebp - 1]
shr bl, 6
and cl, 0xf
shl cl, 2
or cl, bl
movzx ebx, dl
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and dl, 3
mov byte [eax + esi], bl
movzx ebx, byte [ebp - 2]
shl dl, 4
movzx edx, dl
shr ebx, 4
or edx, ebx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov byte [eax + esi], dl
mov edx, dword [ebp - 8]
xor ebx, ebx
inc eax
sub edx, ebx
je 0x421408
dec edx
je 0x4213fa
dec edx
jne 0x421426
mov byte [eax + esi], 0x3d
inc eax
mov byte [eax + esi], 0x3d
jmp 0x421425
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
jmp 0x4213f3
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [ebp - 1]
inc eax
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
inc eax
cmp edi, dword [ebp + 0xc]
jb 0x42135f
mov byte [eax + esi], bl
inc eax
jmp 0x421437
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4215ee
Capabilities:
Terminate thread

Disassembly:
push edi
push 0
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi], 0
je 0x42162a
push 0x1388
mov eax, esi
call fcn.00416936
test al, al
jne 0x42162a
mov eax, dword [esi]
test eax, eax
je 0x42162a
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi], 0
call fcn.0041fb74
pop edi
ret

Function at 0x421b7d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x43e6ac], 0
push esi
jne 0x421af0
call fcn.00421a16
test eax, eax
je 0x421b33
mov eax, dword [0x43e6ac]
cmp eax, 1
jne 0x421b11
push 0xd
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x421b33
pop esi
ret
push eax
call dword [0x43e6b4]
test eax, eax
jne 0x421b7b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x421b37
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x43e6ac]
call dword [0x43e6b4]
mov edi, eax
test edi, edi
je 0x421b5c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x421b78
mov edi, esi
add esi, 0xff0
push edi
push dword [0x43e6ac]
call dword [0x43e6b0]
add edi, 0x10
cmp edi, esi
jb 0x421b64
mov eax, edi
pop edi
pop esi
ret
jmp 0x421add

Function at 0x4282c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c788]
jne 0x4282ca
repz ret
jmp fcn.0042d5ec
Function at 0x42b7e3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004242be
and dword [ebp - 4], 0
cmp dword [0x43eee4], 0
mov ebx, eax
jne 0x42b894
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42b945
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42b945
push eax
call fcn.0042424c
mov dword [esp], 0x430f84
push edi
mov dword [0x43eee4], eax
call esi
push eax
call fcn.0042424c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43eee8], eax
call esi
push eax
call fcn.0042424c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43eeec], eax
call esi
push eax
call fcn.0042424c
pop ecx
mov dword [0x43eef4], eax
test eax, eax
je 0x42b894
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042424c
pop ecx
mov dword [0x43eef0], eax
mov eax, dword [0x43eef0]
cmp eax, ebx
je 0x42b8ec
cmp dword [0x43eef4], ebx
je 0x42b8ec
push eax
call fcn.004242c7
push dword [0x43eef4]
mov esi, eax
call fcn.004242c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42b8ec
test edi, edi
je 0x42b8ec
call esi
test eax, eax
je 0x42b8e3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42b8e3
test byte [ebp - 0xc], 1
jne 0x42b8ec
or dword [ebp + 0x10], 0x200000
jmp 0x42b925
mov eax, dword [0x43eee8]
cmp eax, ebx
je 0x42b925
push eax
call fcn.004242c7
pop ecx
test eax, eax
je 0x42b925
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42b925
mov eax, dword [0x43eeec]
cmp eax, ebx
je 0x42b925
push eax
call fcn.004242c7
pop ecx
test eax, eax
je 0x42b925
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43eee4]
call fcn.004242c7
pop ecx
test eax, eax
je 0x42b945
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42b947
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4033f2
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a44]
test eax, eax
je 0x40340b
call eax
test eax, eax
jne 0x40340b
push 0xfffffffffffffffe
jmp 0x403425
push 1
push 0x406010
push 0x406008
call fcn.00402d4d
add esp, 0xc
test eax, eax
je 0x40342b
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402d4d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403451
mov esi, 0x405c05
mov cl, 0x20
jmp 0x40345a
cmp al, 0x20
ja 0x403464
inc esi
mov al, byte [esi]
test al, al
jne 0x403455
cmp al, 0x20
jbe 0x40347b
mov al, byte [esi]
cmp al, 0x22
jne 0x40346d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403466
jmp 0x40347b
cmp al, cl
ja 0x403481
inc esi
mov al, byte [esi]
test al, al
jne 0x403476
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4034aa
movzx eax, word [ebp - 0x14]
jmp 0x4034ad
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x4034e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40639d], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4068a0
push 0x406908
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403532
xor eax, eax
jmp 0x403549
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]

Function at 0x408936
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
push 0xec7411d0
pop ecx
call fcn.00408965
xor dword [edi], edx
add ecx, esi
mov esi, 0x5575f808
add edi, 1
cmp edi, ebx
jne fcn.00408936
and ecx, ecx
add ecx, 0x43200f67
ret
Function at 0x41c610
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47852b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046cc96
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41c692
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046abad
mov eax, dword [eax]
push 0x4ac234
push eax
call fcn.0045d6e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046cf21
test bl, bl
je 0x41c692
push 0x4ac234
lea ecx, [esp + 0xc]
call fcn.0046d2b1
push 0x4afda4
lea ecx, [esp + 0xc]
call fcn.0046d2b1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41c6ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046cf21
jmp 0x41c799
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41c752
lea edx, [esp + 0x7c]
push 0x4afda0
push edx
call fcn.0045d6e4
add esp, 8
test eax, eax
je 0x41c752
lea eax, [esp + 0x7c]
push 0x4afd9c
push eax
call fcn.0045d6e4
add esp, 8
test eax, eax
je 0x41c752
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c6e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046cf21
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41cf90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41cff2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc