joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517298
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x57cd60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0050b7cb
and dword [ebp - 0x14], 0
cmp dword [0x584d04], 0
mov dword [ebp - 0x18], eax
jne 0x51734b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5173f3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x558e18
push ebx
call edi
test eax, eax
je 0x5173f3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x558e08
push ebx
mov dword [0x584d04], eax
call edi
push eax
call esi
push 0x558df4
push ebx
mov dword [0x584d08], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x584d0c], eax
call edi
push eax
call esi
mov dword [0x584d14], eax
test eax, eax
je 0x51734b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x584d10], eax
mov eax, dword [0x584d10]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5173a4
cmp dword [0x584d14], ecx
je 0x5173a4
push eax
call esi
push dword [0x584d14]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5173a4
test ebx, ebx
je 0x5173a4
call edi
test eax, eax
je 0x51739b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51739b
test byte [ebp - 8], 1
jne 0x5173a4
or dword [ebp + 0x10], 0x200000
jmp 0x5173d7
mov eax, dword [0x584d08]
cmp eax, dword [ebp - 0x18]
je 0x5173d7
push eax
call esi
test eax, eax
je 0x5173d7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5173d7
mov eax, dword [0x584d0c]
cmp eax, dword [ebp - 0x18]
je 0x5173d7
push eax
call esi
test eax, eax
je 0x5173d7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x584d04]
call esi
test eax, eax
je 0x5173f3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5173f5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005048f5
leave
ret
Function at 0x404980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b01c]
push edi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x2ac04dd
nop
push eax
call 0x77f1296e
nop
mov ebx, eax
push 0x434fb0
mov dword [ebp - 4], ebx
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
mov byte [ebx + edi], 0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x6ff643d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x434fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404a26
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x2ac04e2
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xfb53d20
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x59a0775d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4018b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4018c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401904
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401900
lea ebx, [ebx]
cmp esi, eax
jae 0x401904
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4018f0
cmp esi, eax
jb 0x40190a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404e90
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x30]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push Ordinal_3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push eax
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
push edx
push 1
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x48ade8
push 0
push edi
push ecx
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, dword [esp + 0x40]
mov ecx, esi
call fcn.0042291e
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004228c6
mov eax, dword [esi + 4]
lea edx, [esp + 0x1c]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4058c0
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [ecx]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
push esi
push ecx
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
mov esi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405900
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405920
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
ret 0x10

Function at 0x4059f0
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [ecx]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push ecx
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
ret 0xc
Function at 0x405b80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x477198
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.0044b160
mov eax, dword [0x49d73c]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov eax, dword [0x49d73c]
xor eax, esp
push eax
lea eax, [esp + 0x1010]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1020]
mov dword [esp + 8], 0
mov ecx, dword [ecx]
mov edx, dword [esp + 0x1028]
push ecx
mov ecx, dword [esp + 0x1030]
push 0x1000
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1030]
push ecx
push edx
push eax
mov dword [esp + 0x1030], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00402480
mov eax, dword [esp + 0x1024]
add eax, 0xfffffff0
mov byte [esp + 0x1018], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405c38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1028]
add eax, 0xfffffff0
mov byte [esp + 0x1018], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405c63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x102c]
add eax, 0xfffffff0
mov dword [esp + 0x1018], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405c91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.0044a9bf
add esp, 0x1014
ret 0x10
Function at 0x410aa0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x6c8
mov eax, dword [0x49d73c]
xor eax, esp
mov dword [esp + 0x6c4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
push edi
push 0x208
lea ecx, [esp + 0x4c8]
push ecx
lea edi, [esi + 0x12a84]
push 0
mov dword [edi], 0x3b8
mov dword [esi + 0x12a88], eax
mov dword [esi + 0x12a8c], 0x80
mov dword [esi + 0x12a90], 7
mov dword [esi + 0x12a94], 0x7e9
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x101
push 0x2b4
lea edx, [esp + 0x10]
push edx
push 0x80
lea eax, [esp + 0x4d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 8]
mov dword [esi + 0x12a98], ecx
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.Gaming_Mouse_Driver]
mov word [esp + eax + 0x2bc], cx
add eax, 2
test cx, cx
jne 0x410b30
lea eax, [esp + 0x2bc]
lea edx, [esi + 0x12a9c]
mov ecx, eax
sub edx, ecx
jmp 0x410b60
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410b60
push edi
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esp + 0x6cc]
pop edi
pop esi
xor ecx, esp
call fcn.0044a9bf
add esp, 0x6c8
ret

Function at 0x412f20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47886b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x49d73c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x49d73c]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
call fcn.00420868
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412f72
push 0x80004005
call fcn.00401860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x22c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push 0x5c
push edx
call fcn.0044bb69
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x14]
push str._s_trayicon.exe
push eax
call fcn.00402f60
mov esi, dword [esp + 0x1c]
add esp, 0x14
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov dword [esp + 0x220], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413006
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044a9bf
add esp, 0x21c
ret
Function at 0x413300
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47892b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x49d73c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x49d73c]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push str.M711_GAMING_MOUSE_CONFIG
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x413372
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x41335f
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x413420
call fcn.00420868
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41338c
push 0x80004005
call fcn.00401860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x22c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push 0x5c
push edx
call fcn.0044bb69
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x14]
push str._sldcfg.exe
push eax
call fcn.00402f60
mov esi, dword [esp + 0x1c]
add esp, 0x14
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov dword [esp + 0x220], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413420
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044a9bf
add esp, 0x21c
ret
Function at 0x4152c0
Capabilities:
Print debug messages

Disassembly:
push esi
push str.QueryAllFrMouse_n
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
mov ecx, esi
call fcn.004136d0
push 0
mov ecx, esi
call fcn.00411010
mov ecx, esi
call fcn.00411330
mov ecx, esi
call fcn.00411820
mov ecx, esi
call fcn.00411c80
mov ecx, esi
call fcn.00411a90
mov ecx, esi
call fcn.004142c0
mov ecx, esi
call fcn.004117f0
push 1
mov ecx, esi
call fcn.00411010
add esi, 0x58
push esi
call fcn.004101a0
add esp, 4
push str.M711_GAMING_MOUSE_CONFIG
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
pop esi
test eax, eax
je 0x415341
push 0
push 0
push 0x1515
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
ret

Function at 0x415dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [ecx]
test eax, eax
jne 0x415dcb
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 8]
push edx
push 0
push ecx
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
pop ecx
ret 0xc

Function at 0x41d681
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41d6c8
call fcn.0042c004
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41d6c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41d6e4
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041d1f9
mov esi, eax
test edi, edi
je 0x41d6e2
test ebx, ebx
je 0x41d6e2
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41e9cb
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4794a8
call fcn.0044c09b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41e9f0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41ea36
lea ecx, [ebp - 0x10]
call fcn.00402eb0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041de84
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019a0
mov eax, esi
call fcn.0044c173
ret 8
Function at 0x425fcb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x425fef
cmp dword [edi + 0x54], 0
jne 0x425fef
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042c004
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00425f8c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42def7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x47a64e
call fcn.0044c09b
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00402480
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42df59
call fcn.0042b453
cmp eax, 1
jne 0x42df59
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x483208
push eax
call fcn.00428b36
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00402320
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004019a0
mov dword [ebp + 8], Ordinal_3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019a0
mov eax, esi
call fcn.0044c173
ret 0x10

Function at 0x42df82
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x47a679
call fcn.0044c09b
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00402480
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42dfe4
call fcn.0042b453
cmp eax, 1
jne 0x42dfe4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x483208
push eax
call fcn.00428b36
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00402320
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004019a0
mov dword [ebp + 8], Ordinal_3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019a0
mov eax, esi
call fcn.0044c173
ret 0x14

Function at 0x42e010
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x47a6a4
call fcn.0044c09b
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00402480
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42e072
call fcn.0042b453
cmp eax, 1
jne 0x42e072
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x483208
push eax
call fcn.00428b36
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00402320
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004019a0
mov dword [ebp + 8], Ordinal_3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019a0
mov eax, esi
call fcn.0044c173
ret 8
Function at 0x44a9bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49d73c]
jne 0x44a9c9
repz ret
jmp fcn.00453dfc

Function at 0x45f449
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00451ae4
and dword [ebp - 4], 0
cmp dword [0x4a344c], 0
mov ebx, eax
jne 0x45f4fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45f5ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45f5ab
push eax
call fcn.00451a72
mov dword [esp], 0x488f70
push edi
mov dword [0x4a344c], eax
call esi
push eax
call fcn.00451a72
mov dword [esp], 0x488f5c
push edi
mov dword [0x4a3450], eax
call esi
push eax
call fcn.00451a72
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a3454], eax
call esi
push eax
call fcn.00451a72
pop ecx
mov dword [0x4a345c], eax
test eax, eax
je 0x45f4fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00451a72
pop ecx
mov dword [0x4a3458], eax
mov eax, dword [0x4a3458]
cmp eax, ebx
je 0x45f552
cmp dword [0x4a345c], ebx
je 0x45f552
push eax
call fcn.00451aed
push dword [0x4a345c]
mov esi, eax
call fcn.00451aed
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45f552
test edi, edi
je 0x45f552
call esi
test eax, eax
je 0x45f549
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45f549
test byte [ebp - 0xc], 1
jne 0x45f552
or dword [ebp + 0x10], 0x200000
jmp 0x45f58b
mov eax, dword [0x4a3450]
cmp eax, ebx
je 0x45f58b
push eax
call fcn.00451aed
pop ecx
test eax, eax
je 0x45f58b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45f58b
mov eax, dword [0x4a3454]
cmp eax, ebx
je 0x45f58b
push eax
call fcn.00451aed
pop ecx
test eax, eax
je 0x45f58b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a344c]
call fcn.00451aed
pop ecx
test eax, eax
je 0x45f5ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45f5ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7ffe5442
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
cld
call 0x7ffe544e
pop edx
push eax
pop eax
push es
pop ds
xor dx, dx
cld
add edx, 0xd5e0
inc esi
dec esi
xor ecx, ecx
push edx
cdq
pop edx
mov cl, 0x1e
not eax
not eax
xor byte [ecx + edx], 0x87
loop 0x7ffe546a
inc esi
dec esi
clc
push es
pop ds
push dword fs:[0x24]
pop dword [edx + 0xa]
clc
mov cl, 0xff
add al, 0
add al, 0
push edx
loop 0x7ffe5486
push es
pop ds
cld
mov dword [edx + 0x11], 0xffffacbb
and al, 0xff
and al, 0xff
mov ecx, dword [eax + 0x2c]
cld
push eax
pop eax
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
and al, 0xff
pushal
inc eax
popal
mov dword [eax + 0x2c], esp
push es
pop ds
and al, 0xff
push 0
inc esi
dec esi
pushal
inc eax
popal
push 0
push eax
pop eax
push eax
pop eax
push 0
add eax, 0
push 0
xor eax, ecx
xor eax, ecx
push 0x30
clc
push 0x20
add al, 4
sub al, 4
push 0
push eax
pop eax
pushal
inc eax
popal
push 0
and al, 0xff
push eax
pop eax
add edx, 0xffff7f31
push es
pop ds
clc
push edx
push eax
pop eax
push edx
inc esi
dec esi
stc
push 0
push eax
pop eax
call dword [edx + 0x8212]
lea esp, [esp]
add esp, 0x3f8
xor eax, eax
not eax
not eax
cld
inc eax
ret 0xc