joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472380
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47252d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x47250e
mov dl, 1
mov eax, dword [0x422fcc]
call fcn.004283bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.00405b28
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4724fd
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004622a4
test al, al
je 0x4724f0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x47253c
lea eax, [ebp - 0x394]
call fcn.0040d00c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4724f0
xor eax, eax
push ebp
push 0x4724e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4725ac
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4724d2
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405d28
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4724d2
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4724f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4723f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004281a8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472534
lea eax, [ebp - 0x3a0]
call fcn.00405b18
ret

Function at 0x472f1c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4e8188]
cmp byte [eax + 0xa9], 0
jne 0x472f8e
cmp dword [0x4e81a0], 0
jne 0x472f4e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4dfc64]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4e81a0], eax
cmp dword [0x4e819c], 0
jne 0x472f69
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4e819c], eax
cmp dword [0x4e81a4], 0
jne 0x472f8e
push esp
push 0
push 0
mov eax, dword [0x4dfc60]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4e81a4], eax
pop edx
ret
Function at 0x4731a4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4731bb
add esp, 0xfffffff0
call fcn.00404100
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042f290
mov eax, dword [0x4e20e0]
cmp byte [eax], 0
jne 0x4731e8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4e2538]
cmp word [eax + 2], 0
jne 0x473202
mov eax, dword [0x4e2538]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004750f0
mov eax, dword [0x4e2688]
cmp word [eax + 2], 0
jne 0x47321c
mov eax, dword [0x4e2688]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00475300
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x4337c4]
call fcn.004354c8
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x475784
mov dl, 1
mov eax, dword [0x4228e8]
call fcn.00403bec
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4228e8]
call fcn.00403bec
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x4342a0]
call fcn.0043c6f4
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x4733f8
mov eax, dword [0x4e2350]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0043caf8
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x475a34
mov dl, 1
mov eax, dword [0x4228e8]
call fcn.00403bec
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4e2350]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040cdfc
test eax, eax
je 0x47332a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040cb4c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040cde4
test eax, eax
je 0x473342
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405d28
push ebx
push 0x474b04
call fcn.004699fc
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4e20e0]
cmp byte [eax], 0
jne 0x473393
mov eax, ebx
call fcn.0047356c
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.00475c5c
mov eax, ebx
call fcn.00476820
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4733f0
call fcn.00404158
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473814
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4738b6
cmp dword [ebx + 0x90], 0
jne 0x4738b0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x47378c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x4738b0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x473876
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4738b0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00425404
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x473885
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x473ad4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4e8188]
cmp dword [eax + 0x170], 0
je 0x473c39
test bl, bl
jne 0x473b87
cmp dword [esi + 0x98], 0
jne 0x473b7c
mov eax, esi
call fcn.00476670
push eax
push 0x4739e0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x473b4d
mov eax, dword [0x4e8188]
cmp byte [eax + 0xcf], 0
je 0x473b4d
mov eax, dword [esi + 0xd4]
call fcn.0040707c
mov edi, eax
cmp edi, 0
jl 0x473b4d
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x473b36
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x473b7c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00425404
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x473b5c
inc dword [esi + 0x98]
jmp 0x473c39
cmp dword [esi + 0x98], 0
jle 0x473c39
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x473c39
cmp dword [esi + 0x40], 0
je 0x473be4
mov eax, dword [0x4e8188]
cmp byte [eax + 0xcf], 0
je 0x473be4
mov eax, dword [esi + 0xd4]
call fcn.0040707c
mov edi, eax
cmp edi, 0
jl 0x473be4
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x473bcd
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x473c13
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00425404
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x473bf3
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x469408]
call fcn.0040723c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4747f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x47485f
cmp byte [ebx + 0xcf], 0
jne 0x47485f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405c64
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x47484c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47486c
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405b28
jmp 0x47486c
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405b28
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x475e30
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x475e9e
mov eax, esi
call fcn.0045ccb4
test al, al
je 0x475e9e
mov eax, dword [ebx + 0x80]
call fcn.0045c908
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x475e9e
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x475e92
push 0
mov eax, dword [ebx + 0x80]
call fcn.0045c908
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00453fb0
jmp 0x475e9e
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00475c7c
pop esi
pop ebx
ret
Function at 0x48e8bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x48e917
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x48e90d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x48e91b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4c8504
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x4c8529
cmp dword [esp + 4], 5
jb 0x4c8529
mov al, 1
jmp 0x4c852b
xor eax, eax
add esp, 0x114
ret
Function at 0x4016f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x405101], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401737
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401f47
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401f60
call eax
test eax, eax
jne 0x401f60
push 0xfffffffffffffffe
jmp 0x401f7a
push 1
push 0x405010
push 0x405008
call fcn.00401b41
add esp, 0xc
test eax, eax
je 0x401f80
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b41
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x401fa6
mov esi, 0x404c1e
mov cl, 0x20
jmp 0x401faf
cmp al, 0x20
ja 0x401fb9
inc esi
mov al, byte [esi]
test al, al
jne 0x401faa
cmp al, 0x20
jbe 0x401fd0
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc2
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x401fbb
jmp 0x401fd0
cmp al, cl
ja 0x401fd6
inc esi
mov al, byte [esi]
test al, al
jne 0x401fcb
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x401fff
movzx eax, word [ebp - 0x14]
jmp 0x402002
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402037
pop ecx
pop esi
leave
ret

Function at 0x402037
Capabilities:
Terminate process

Disassembly:
call fcn.00402081
push 0
push 0x405018
push 0x405014
call fcn.00401b41
push 0
push 0x405020
push 0x40501c
call fcn.00401b41
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401060
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [esp + 0x354]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x401084
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x344
ret
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4010ac
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x344
ret
mov cl, byte [0x403020]
xor eax, eax
mov byte [esp + 0x250], cl
mov ecx, 0x40
lea edi, [esp + 0x251]
lea edx, [esp + 0x48]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x50]
push eax
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x40]
push edx
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x44]
push ebx
lea edx, [esp + 0x274]
push ecx
mov ebp, 0xff
push edx
push eax
mov dword [esp + 0x54], 0x104
mov dword [esp + 0x58], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x18], ebx
je 0x4011f4
lea ecx, [esp + 0x34]
lea edx, [esp + 0x10]
push ecx
push edx
push ebx
push 0x20106
push ebx
push ebx
push ebx
push esi
push 0x80000002
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401164
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x344
ret
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, ebx
jbe 0x4011e0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x150]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push ebx
lea ecx, [esp + 0x60]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x40], ebp
mov byte [esp + 0x70], bl
mov byte [esp + 0x170], bl
mov dword [esp + 0x3c], ebp
call edi
test eax, eax
jne 0x4011d7
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x150]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x5c]
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401201
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jb 0x401174
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x344
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x344
ret
Function at 0x401220
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x120]
stosw word es:[edi], ax
push ebp
stosb byte es:[edi], al
call fcn.00401390
add esp, 4
push 0
push 0x100
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
test eax, eax
jne 0x40126f
pop edi
mov al, 1
pop ebp
add esp, 0x114
ret
mov al, byte [esp + 0x124]
test al, al
jne 0x401285
pop edi
mov al, 1
pop ebp
add esp, 0x114
ret
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4012b0
cmp eax, 2
pop edi
sete al
pop ebp
add esp, 0x114
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov al, byte [esi + ebp - 1]
add esi, ebp
cmp al, 0x5c
je 0x4012cb
mov byte [esi], 0x5c
inc esi
mov byte [esi], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40135a
lea edx, [esp + 0x1c]
mov edi, 0x208
mov eax, esi
sub edx, esi
mov cl, byte [edx + eax]
test cl, cl
je 0x401315
mov byte [eax], cl
inc eax
dec edi
jne 0x401306
jmp 0x401319
test edi, edi
jne 0x40131a
dec eax
push 1
push ebp
mov byte [eax], 0
call fcn.00401220
add esp, 8
test al, al
je 0x40135a
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4012f9
mov byte [esi - 1], 0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push ebp
call fcn.00401220
add esp, 8
test al, al
pop esi
pop edi
sete al
pop ebp
add esp, 0x114
ret
Function at 0x40206c
Capabilities:
Allocate or change rwx memory

Disassembly:
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.00401fe6
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
jmp 0x4020ea
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
jmp 0x402010
or al, 0x40
mov edi, 0x40389b
push eax
sub edi, fcn.00403045
push edi
push fcn.00403045
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402129
mov eax, fcn.00403045
mov ebx, esi
mov edx, edi
call fcn.00401fe6
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call fcn.00402630
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.00402bb7
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00403045
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403060
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
jmp fcn.004a6b19

Function at 0x4053a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4aeed9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [0x4d8cb8]
mov dword [esp + 0x168], 0
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x170]
mov byte [esp + 0x168], 1
push ecx
lea ecx, [esp + 0x14]
call fcn.004a6f31
lea edx, [esp + 0x10]
push str..
lea eax, [esp + 0x18]
push edx
push eax
call fcn.004a6dae
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
lea ecx, [esp + 0x14]
cmp ebp, 0xffffffff
setne bl
call fcn.004a6b19
test bl, bl
je 0x405561
lea edx, [esp + 0x20]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x405561
mov ebx, 2
mov eax, dword [esp + 0x20]
and eax, 0x10
cmp al, 0x10
jne 0x405504
mov esi, 0x4cdd40
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40547c
test cl, cl
je 0x405478
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40547c
add eax, ebx
add esi, ebx
test cl, cl
jne 0x40545a
xor eax, eax
jmp 0x405481
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40554d
mov esi, 0x4cdd3c
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4054b4
test cl, cl
je 0x4054b0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4054b4
add eax, ebx
add esi, ebx
test cl, cl
jne 0x405492
xor eax, eax
jmp 0x4054b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40554d
lea eax, [esp + 0x10]
push 0x4cdd38
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004a6dae
push ecx
lea ecx, [esp + 0x50]
mov edx, esp
mov dword [esp + 0x20], esp
push ecx
push eax
push edx
mov byte [esp + 0x178], bl
call fcn.004a6dae
mov ecx, edi
call fcn.004053a0
mov byte [esp + 0x168], 1
lea ecx, [esp + 0x14]
jmp 0x405548
push 1
lea edx, [esp + 0x14]
push 0x4cdd38
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004a6dae
push ecx
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
push eax
push ecx
mov byte [esp + 0x17c], 3
call fcn.004a6dae
mov ecx, edi
call fcn.004051d0
mov byte [esp + 0x168], 1
lea ecx, [esp + 0x18]
call fcn.004a6b19
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405442
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 0
call fcn.004a6b19
lea ecx, [esp + 0x170]
mov dword [esp + 0x168], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x15c
ret 4