joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40afe9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004124e3
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004124e3
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x40b07f
mov dword [ebp - 0x18], esp
mov eax, 0x49
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b07c
push 6
call fcn.004124e9
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b0ab
push 6
call fcn.004124e9
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x4a
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b0d9
push 6
call fcn.004124e9
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x879549
push 0
mov eax, 0x4b
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b105
push 6
call fcn.004124e9
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x4c
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b194
push 6
call fcn.004124e9
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 2
call fcn.004124ef
cmp dword [ebp - 0x18], esp
je 0x40b1b9
push 6
call fcn.004124e9
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40b1c1
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004124d7
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004124d7
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x434540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8b9a28]
xor edx, edx
cmp eax, edx
jne 0x434566
xor eax, eax
mov byte [eax + 0x8b9928], al
inc eax
cmp eax, 0x100
jl 0x43454e
mov dword [0x8b9a28], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8b9928
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4345f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4345ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x434598
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x434670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4346c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4346aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448f30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49a1f8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x448f69
inc eax
mov dword [esi + 0x10], eax
jmp 0x44907c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x448f7d
mov eax, 0xffffffc7
jmp 0x44907e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x448f8e
cmp dword [esi + 8], eax
jne 0x448f7d
cmp dword [esi + 8], eax
jne 0x448fa7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x448fa7
mov eax, 0xffffffc7
jmp 0x44907e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x448fbb
push eax
mov ecx, ebx
call fcn.00448760
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00416770
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x448fec
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00416790
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00447ed0
test eax, eax
mov dword [esp + 0x38], eax
je 0x44901f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x88aa78
call fcn.00416970
mov eax, dword [esp + 0x38]
jmp 0x44907e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00448d90
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x449063
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00448db0
mov esi, eax
test esi, esi
jne 0x449093
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00448d90
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x449035
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x88aa78
call fcn.00416970
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x88aa78
call fcn.00416970
mov eax, esi
jmp 0x44907e
Function at 0x4022f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTouchkitCalDafualt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40235f
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push 4
push eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 8]
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402354
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x403cb0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x406d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00406612
mov eax, dword [esi + 0x140]
test eax, eax
jne 0x403da6
mov edx, dword [esi + 0x17c]
mov eax, dword [esi + 0x184]
mov ecx, dword [esi + 0x180]
mov edx, dword [edx + 0x118]
push edx
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 0x18c]
push 0
sub edx, eax
push 0
push edx
mov edx, dword [esi + 0x188]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x34]
push ecx
push 0x80000000
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [esi + 0x140], eax
je 0x403da6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x184]
mov edx, dword [esi + 0x18c]
mov ecx, dword [esi + 0x180]
sub edx, eax
push 0x41
push edx
mov edx, dword [esi + 0x188]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x140]
push ecx
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0x140]
push esi
push 0xffffffffffffffeb
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x405af0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x406f6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4083d0
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x18], ebx
call fcn.00406612
lea ecx, [esi + 0x134]
mov byte [esp + 0x18], 1
call fcn.00406612
lea ecx, [esi + 0x138]
mov byte [esp + 0x18], 2
call fcn.00406612
lea ecx, [esi + 0x13c]
mov byte [esp + 0x18], 3
call fcn.00406612
lea ecx, [esi + 0x1c8]
mov byte [esp + 0x18], 4
call fcn.00406612
mov eax, 0x1e
lea edi, [esi + 0x144]
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov eax, 0xffff
mov ecx, 0x20
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, 0x12c
mov dword [esi], 0x4084f4
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x2c], 0x2580
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x140], ebx
rep stosd dword es:[edi], eax
mov byte [esp + 0x18], 5
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x20c], ebx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, dword [eax + 0x118]
mov dword [esi + 0x210], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
std
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edi, [esi + ecx + 7]
push esi
push ecx
lea esi, [esi + ecx]
dec esi
rep movsb byte es:[edi], byte [esi]
pop ecx
pop esi
lea eax, [ecx + 8]
mov dword [ebp - 4], eax
mov edi, esi
xor eax, eax
test cl, 3
je 0x401865
inc eax
shr ecx, 2
add ecx, eax
shl ecx, 2
call fcn.0040194b
cld
stosd dword es:[edi], eax
mov edx, eax
lea eax, [ecx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
stosd dword es:[edi], eax
shr ecx, 2
mov esi, edi
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
mov edx, eax
loop 0x401885
popal
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x4020f1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
pushal
lea esi, [ebp - 0x54]
lea edi, [ebp - 0x10]
push 0
push 0x44
push esi
call fcn.0040171c
push 0
push 0x10
push edi
call fcn.0040171c
mov dword [ebp - 0x54], 0x44
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x402162
push dword [ebp + 8]
lea edx, [ebp - 0x25c]
push edx
call fcn.004015e9
lea edx, [ebp - 0x25c]
push edx
call fcn.00401769
lea ecx, [ebp - 0x25c]
mov dword [eax + ecx], 0x20
push dword [ebp + 0xc]
lea edx, [ebp - 0x25c]
push edx
call fcn.004016fd
lea eax, [ebp - 0x25c]
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
popal
leave
ret 8

Function at 0x40217e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], 0
pushal
mov edi, dword [ebp + 8]
cld
rdtsc
xor eax, edx
and eax, 0xf0f0f
add eax, 0x616161
mov dword [ebp - 4], eax
push edi
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x4021eb
lea edx, [ebp - 0x108]
push edx
push 0
lea edx, [ebp - 4]
push edx
push edi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x4021eb
push 0x104
lea edx, [ebp - 0x108]
push edx
push edi
call fcn.00401731
mov dword [ebp - 0x10c], 1
popal
mov eax, dword [ebp - 0x10c]
leave
ret 4

Function at 0x40225c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 1
jne 0x402277
mov dword [ebp + 0x14], 3
push 0
push pe_nt_image_headers32
push 2
push 0
push dword [ebp + 0x14]
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x4022c0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x4022c0
mov dword [ebp - 8], 0
popal
mov eax, dword [ebp - 8]
leave
ret 0x10
Function at 0x40232a
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x64
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x4023eb
push 0
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, dword [ebp + 0x14]
jecxz 0x402389
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
jecxz 0x402390
mov eax, ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4023af
cmp dword [ebp + 0x10], 0
je 0x40240f
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
test eax, eax
je 0x40240f
mov esi, eax
mov edi, esi
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
je 0x4023e6
test eax, eax
je 0x4023e6
add esi, eax
dec dword [ebp - 8]
jne 0x4023b3
cmp dword [ebp + 0xc], 0
je 0x40240f
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x40240f
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
jne 0x402379
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
popal
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x4024e2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40251b
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x402560
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402581
jb 0x402576
outsb dx, byte [esi]
je 0x40256a
jb 0x40258a
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x4025f2
lea edx, [ebp - 0x104]
push edx
call fcn.00402477
cmp eax, 1
je 0x4025a7
inc dword [ebp - 0x108]
jmp 0x40255b
cmp dword [ebp + 8], 0
je 0x4025e8
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004017d9
push dword [ebp + 8]
push eax
call fcn.004015e9
cmp dword [ebp + 0xc], 0
je 0x4025e8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x4025f2
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc
Function at 0x40251b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40251b
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x402560
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402581
jb 0x402576
outsb dx, byte [esi]
je 0x40256a
jb 0x40258a
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x4025f2
lea edx, [ebp - 0x104]
push edx
call fcn.00402477
cmp eax, 1
je 0x4025a7
inc dword [ebp - 0x108]
jmp 0x40255b
cmp dword [ebp + 8], 0
je 0x4025e8
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004017d9
push dword [ebp + 8]
push eax
call fcn.004015e9
cmp dword [ebp + 0xc], 0
je 0x4025e8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x4025f2
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc

Function at 0x402f86
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
pushal
lea edx, [ebp - 0x208]
push edx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push 0x40601c
lea edx, [ebp - 0x208]
push edx
call fcn.004016fd
lea edx, [ebp - 0x104]
push edx
call fcn.0040217e
push 0x406214
lea edx, [ebp - 0x104]
push edx
call fcn.004016fd
push 0
push 0x1db
push 0x406039
lea edx, [ebp - 0x208]
push edx
call fcn.0040225c
push 0
push 0x278
push 0x40622d
lea edx, [ebp - 0x104]
push edx
call fcn.0040225c
push 0x406219
lea edx, [ebp - 0x104]
push edx
call fcn.004016fd
cmp eax, 0
je 0x40304c
lea edx, [ebp - 0x104]
push edx
push 0x406010
call fcn.004020f1
push 0x7d0
call dword [sym.imp.kernel32.dll_Sleep]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
popal
leave
ret
Function at 0x40309f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov edi, 0x420108
push 0
push 0xa
push edi
call fcn.004018e6
push edi
call fcn.00401769
add edi, eax
lea edx, [eax + 1]
inc edi
push edi
mov esi, 0x40a418
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a3b4
mov ecx, 0x64
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a42c
mov ecx, 0x4388
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [edx + 0x4400]
push eax
push 0x420108
call fcn.00401839
mov edi, eax
push section..bss
call fcn.0040304f
push 0
push section..bss
push 0x419a67
call fcn.0040267f
push 1
push 0
push 0
push 0
call fcn.0040316d
push section..bss
push 0x41984a
call fcn.004017d9
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x40316a
push edi
push 0x420108
push 3
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
popal
leave
ret

Function at 0x40353f
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 0x24], 1
pushal
mov dword [ebp - 0x28], 0
mov edi, 0x419c70
cld
mov eax, 0x402d4d
stosd dword es:[edi], eax
mov eax, 0x402bb4
stosd dword es:[edi], eax
mov eax, 0x402c97
stosd dword es:[edi], eax
mov eax, 0x402cf5
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403422
cmp eax, 1
je 0x4035f8
push 0x3e8
push 0x438bd0
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov al, byte [0x438bd0]
mov byte [0x438cd4], al
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
push dword [ebp - 0x24]
pop dword [0x438938]
push 0x43893c
push 0x419af1
call fcn.004022c8
mov dword [0x438954], eax
test eax, eax
jne 0x4035dd
push 0x43893c
push 0x419b35
call fcn.004022c8
test eax, eax
je 0x4035f8
mov dword [0x438954], eax
push 0x43895c
push 0x419b76
call fcn.004022c8
mov dword [0x438958], eax
test eax, eax
je 0x4035f8
mov dword [ebp - 0x28], eax
popal
mov eax, dword [ebp - 0x28]
leave
ret

Function at 0x40425a
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004056de
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x2c
lea edx, [ebp - 0x38]
push edx
call fcn.0040171c
mov ecx, esi
lea edx, [ebp - 0x38]
call fcn.004026eb
test eax, eax
je 0x4042ef
cmp byte [ebp - 0x25], 0xcc
jne 0x4042b0
inc dword [ebp - 0xc]
jmp 0x4042df
mov ecx, dword [ebp - 0xc]
jecxz 0x4042df
cmp ecx, dword [ebp + 0x14]
jb 0x4042d8
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004041e7
cmp eax, 1
jne 0x4042ef
add dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x28]
jae 0x4042ef
mov dword [ebp - 0xc], 0
xor eax, eax
mov al, byte [ebp - 0x38]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x404297
popal
mov eax, dword [ebp - 8]
leave
ret 0x24