joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40666c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4066cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.00405380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066d3
lea eax, [ebp - 0x1c]
call fcn.0040371c
ret

Function at 0x4066d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406757
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040387c
lea eax, [ebp - 0x10c]
mov edx, 0x40676c
call fcn.0040389c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
shr eax, cl
jle 0x406728
invalid
push dword [ebx]
rcr byte [edx + 0x59], 0x59
mov dword fs:[eax], edx
push 0x40675e
lea eax, [ebp - 0x10c]
call fcn.0040371c
ret

Function at 0x406874
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406917
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x41d6bc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41d6c0], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41d6c0], eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40691e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x406928
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4069ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41d6bc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41d6c0], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403bc4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
jne 0x4069bf
mov eax, dword [ebx]
call fcn.00403a94
mov edx, eax
mov eax, ebx
call fcn.0040384c
jmp 0x4069c6
mov eax, ebx
call fcn.0040371c
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069f3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x4069fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
mov eax, dword [ebp + 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406ad0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41d6bc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41d6c0], eax
cmp dword [ebp + 8], 0
jne 0x406a69
lea eax, [ebp + 8]
mov edx, 0x406ae8
call fcn.004037b4
mov eax, dword [ebp + 8]
call fcn.00403894
push eax
lea eax, [ebp + 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
sete bl
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ad7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
lea eax, [ebp + 8]
call fcn.0040371c
ret
Function at 0x406aec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406b91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41d6bc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41d6c0], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
sete bl
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406ba4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406c26
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406c3c
call fcn.00405818
test al, al
jne 0x406c10
mov eax, dword [ebp - 4]
call fcn.00403a94
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x41d6bc
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c2d
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406cd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406d5f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406d10
lea eax, [ebp - 8]
mov edx, 0x406d78
call fcn.004037b4
mov eax, dword [ebp - 8]
call fcn.00403894
push eax
lea eax, [ebp - 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d66
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x406d7c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406ddf
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406de6
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406df0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406e86
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41d6bc
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41d6c0], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x41d6c0], eax
cmp dword [0x41d6c0], 0
sete bl
mov eax, dword [0x41d6bc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e8d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x407c44
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x41db54
xor eax, eax
push ebp
push 0x407ee7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x407efc
call fcn.00403770
lea eax, [ebp - 4]
mov ecx, 0x407f60
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407f74
mov edx, 0x407f84
mov eax, 0x80000002
call fcn.004069fc
mov ecx, 0x407f60
lea eax, [ebp - 8]
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x407f74
mov edx, 0x407fbc
mov eax, 0x80000001
call fcn.004069fc
mov eax, ebx
mov edx, 0x408004
call fcn.00403770
mov ecx, 0x407f60
lea eax, [ebp - 0xc]
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407f74
mov edx, 0x4080d4
mov eax, 0x80000002
call fcn.004069fc
lea eax, [ebp - 0x10]
mov ecx, 0x408114
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407f84
mov ecx, 0x408128
mov eax, 0x80000001
call fcn.004069fc
mov eax, ebx
mov edx, 0x408138
call fcn.00403770
lea eax, [ebp - 0x14]
mov ecx, 0x4081b4
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x407fbc
mov ecx, 0x4081c8
mov eax, 0x80000002
call fcn.004069fc
cmp byte [0x41db9c], 0
jne 0x407ecc
mov eax, ebx
mov edx, 0x4081d8
call fcn.00403770
push 0
mov ecx, 0x4082ac
mov edx, 0x4082c4
mov eax, 0x80000002
call fcn.004069fc
push 0x4082f8
mov edx, 0x4082c4
mov ecx, 0x408308
mov eax, 0x80000002
call fcn.004069fc
push 0x408320
mov edx, 0x4082c4
mov ecx, 0x408358
mov eax, 0x80000002
call fcn.004069fc
push 0x40836c
mov edx, 0x4082c4
mov ecx, 0x408388
mov eax, 0x80000002
call fcn.004069fc
mov eax, ebx
mov edx, 0x40839c
call fcn.00403770
push 0x408444
mov edx, 0x4082c4
mov ecx, 0x408458
mov eax, 0x80000002
call fcn.004069fc
mov eax, ebx
mov edx, 0x408468
call fcn.00403770
push 0x4084c0
mov edx, 0x4082c4
mov ecx, 0x4084d4
mov eax, 0x80000002
call fcn.004069fc
mov ecx, 0x407f60
lea eax, [ebp - 0x18]
mov edx, dword [0x41db1c]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x4082c4
mov ecx, 0x4084e8
mov eax, 0x80000002
call fcn.004069fc
push 1
mov edx, 0x4082c4
mov ecx, 0x4084fc
mov eax, 0x80000002
call fcn.00406aec
mov eax, ebx
mov edx, 0x408514
call fcn.00403770
push 3
mov edx, 0x4082c4
mov ecx, 0x408548
mov eax, 0x80000002
call fcn.00406aec
push 2
mov edx, 0x4082c4
mov ecx, 0x408564
mov eax, 0x80000002
call fcn.00406aec
mov eax, ebx
mov edx, 0x408574
call fcn.00403770
push 0x120
mov edx, 0x4082c4
mov ecx, 0x4085c0
mov eax, 0x80000002
call fcn.00406aec
mov eax, ebx
mov edx, 0x4085d0
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407eee
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403740
ret
Function at 0x40eb64
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40eb6c
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x40edce
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40edb3
mov eax, 0x41db54
mov edx, 0x40ede4
call fcn.00403770
mov dword [ebp - 0xc], 0x7e0
mov eax, 0x41db54
mov edx, 0x40ee4c
call fcn.00403770
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40ebff
cmp eax, 0xea
jne 0x40ed7e
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40ebd7
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40ec21
lea eax, [esi + edi*8]
call fcn.0040eb64
cmp dword [esi + edi*8 + 8], 3
jne 0x40ed6f
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040384c
mov edx, dword [ebp - 0x14]
mov eax, 0x41db3c
mov ecx, 0x40eee4
call fcn.004038e0
inc dword [0x41db84]
mov eax, 0x41db54
mov edx, 0x40eef0
call fcn.00403770
mov eax, dword [0x41db84]
cmp eax, dword [0x41db88]
jl 0x40ed6f
mov eax, dword [0x41db84]
push eax
mov ecx, 0x40ef60
mov edx, 0x40ef70
mov eax, 0x80000002
call fcn.00406aec
mov eax, 0x41db54
mov edx, 0x40efb8
call fcn.00403770
mov eax, dword [0x41db3c]
push eax
mov edx, 0x40ef70
mov ecx, 0x40f074
mov eax, 0x80000002
call fcn.004069fc
xor eax, eax
mov dword [0x41db80], eax
mov word [0x41c298], 0
mov eax, 0x41db54
mov edx, 0x40f084
call fcn.00403770
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x41db18]
call fcn.00403894
mov ecx, eax
mov edx, 3
mov eax, dword [0x41db3c]
call fcn.00403af4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00405380
mov eax, dword [ebp - 0x18]
mov edx, dword [0x41db18]
call fcn.004039e0
jne 0x40ed29
lea eax, [ebp - 0x20]
mov ecx, dword [0x41db3c]
mov edx, 0x40f0e0
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.0041a4a8
jmp 0x40ed4e
mov eax, dword [0x41db3c]
call fcn.0040e038
lea eax, [ebp - 0x24]
mov ecx, dword [0x41db3c]
mov edx, 0x40f0f4
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.0041a4a8
xor eax, eax
mov dword [0x41db7c], eax
mov eax, dword [0x41db7c]
push eax
mov edx, 0x40ef70
mov ecx, 0x40f104
mov eax, 0x80000002
call fcn.00406aec
inc ebx
dec dword [ebp - 0x10]
jne 0x40ec0d
jmp 0x40ebd7
mov eax, esi
call fcn.004024f0
mov eax, 0x41db54
mov edx, 0x40f114
call fcn.00403770
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40edb3
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004062c0
mov eax, dword [ebp - 0x28]
call fcn.0041a4a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40edd5
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00403740
ret
Function at 0x410a48
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x41db54
mov edx, 0x410acc
call fcn.00403770
push 0
push 0
push 0x410b0c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41db54
mov edx, 0x410b20
call fcn.00403770
push 0
push 0
push 0x410bc8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41db54
mov edx, 0x410bf0
call fcn.00403770
push 0
push 0
push 0x410c14
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41db54
mov edx, 0x410c2c
call fcn.00403770
ret
Function at 0x4167e8
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, 0x41db54
xor eax, eax
push ebp
push 0x416a08
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004053bc
mov edx, dword [ebp - 4]
mov eax, 0x41db28
call fcn.00403770
mov eax, edi
mov edx, 0x416a20
call fcn.00403770
cmp byte [0x41db9d], 0
jne 0x416856
mov eax, dword [0x41db28]
push eax
mov ecx, 0x416af4
mov edx, 0x416b04
mov eax, 0x80000002
call fcn.004069fc
mov eax, edi
mov edx, 0x416b4c
call fcn.00403770
cmp byte [0x41db9d], 0
je 0x416875
call fcn.004172ac
jmp 0x4169ed
mov eax, edi
mov edx, 0x416c04
call fcn.00403770
xor ebx, ebx
push 0
push 0x416c34
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x4168a1
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x416883
mov eax, edi
mov edx, 0x416c4c
call fcn.00403770
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x416c6c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
mov eax, edi
mov edx, 0x416c7c
call fcn.00403770
push 0x416d3c
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov eax, edi
mov edx, 0x416d50
call fcn.00403770
test esi, esi
jne 0x4168fc
push 0x416dd8
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4169a7
mov eax, edi
mov edx, 0x416dec
call fcn.00403770
push 0x416e60
push esi
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x4169a7
mov eax, edi
mov edx, 0x416e78
call fcn.00403770
call esi
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
mov eax, edi
mov edx, 0x416f10
call fcn.00403770
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x416f44
call fcn.00406fa0
mov eax, edi
mov edx, 0x416f54
call fcn.00403770
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x417000
call fcn.00403770
mov eax, edi
mov edx, 0x417088
call fcn.00403770
mov edx, 0x417150
mov eax, 0x41dbb0
mov ecx, 0xbb8
call fcn.00406770
test al, al
je 0x4169ed
call fcn.004172ac
mov eax, edi
mov edx, 0x417180
call fcn.00403770
call fcn.0041a258
mov eax, edi
mov edx, 0x4171f8
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416a0f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x41a4a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x41a5ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x41dba4], 0
jne 0x41a4da
call fcn.0041a3a8
push 2
push 0
push 0
mov eax, dword [0x41dba4]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x41a4f5
call fcn.0041a3a8
mov eax, 0x41db54
mov edx, 0x41a5c4
call fcn.00403770
lea edx, [ebp - 0xc]
mov al, byte [0x41db9e]
call fcn.004053f8
push dword [ebp - 0xc]
push 0x41a660
push dword [ebp - 4]
push 0x41a66c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403954
mov eax, 0x41db54
mov edx, 0x41a678
call fcn.00403770
mov byte [0x41db9e], 0
mov eax, 0x41db54
mov edx, 0x41a734
call fcn.00403770
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403894
push eax
lea eax, [ebp - 4]
call fcn.00403aec
push eax
mov eax, dword [0x41dba4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x41a581
mov dword [ebp - 8], 0xffffffff
mov eax, 0x41db54
mov edx, 0x41a7e4
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a5b5
lea eax, [ebp - 0xc]
call fcn.0040371c
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x401031
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403110], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403114], eax
push 0xa
push dword [0x403114]
push 0
push dword [0x403110]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40113b
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x403110]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.PSIDlgSwicth
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0x3f
call sub.user32.dll_GetSystemMetrics
cmp eax, 3
jne 0x4010bb
push eax
add eax, 0x1d
and eax, eax
jne 0x4010a6
nop
pop eax
push 0x400000
push 0
call fcn.00401374
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.MyApp
push str.PSIDlgSwicth
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401134
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40110d
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x4011cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, str.GetLastError
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f5
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40300c
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f5
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x401290
push eax
jmp 0x40129e
cmp eax, 0x7f
jne 0x40129c
push 0x100
jmp 0x40129e
push 1
mov esi, dword [ebp + 8]
mov ebx, 0xa
mov ecx, dword [ebp + 0xc]
shr ecx, 2
xor edx, edx
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
add edx, 2
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x259d23e6
pop edx
xor dword [esi], edx
add esi, 4
loop 0x4012ac
pop eax
popal
leave
ret 0x10