joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c7d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a0018
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x44c809
inc eax
mov dword [esi + 0x10], eax
jmp 0x44c91c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x44c81d
mov eax, 0xffffffc7
jmp 0x44c91e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x44c82e
cmp dword [esi + 8], eax
jne 0x44c81d
cmp dword [esi + 8], eax
jne 0x44c847
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x44c847
mov eax, 0xffffffc7
jmp 0x44c91e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x44c85b
push eax
mov ecx, ebx
call fcn.0044c000
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004191a0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x44c88c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004191c0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0044b770
test eax, eax
mov dword [esp + 0x38], eax
je 0x44c8bf
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6173c8
call fcn.004193a0
mov eax, dword [esp + 0x38]
jmp 0x44c91e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0044c630
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x44c903
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0044c650
mov esi, eax
test esi, esi
jne 0x44c933
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0044c630
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x44c8d5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6173c8
call fcn.004193a0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6173c8
call fcn.004193a0
mov eax, esi
jmp 0x44c91e
Function at 0x401240
Capabilities:
Find taskbar

Disassembly:
push edi
push 2
push 2
push 1
push 1
push ebx
call dword [sym.imp.USER32.dll_SetRect]
xor edi, edi
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4012a1
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
test eax, eax
je 0x4012a5
push edi
push str.TrayClockWClass
push edi
push eax
call esi
test eax, eax
je 0x4012a5
push eax
call fcn.0043e4b5
mov esi, eax
test esi, esi
je 0x4012a7
mov eax, dword [esi + 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, esi
pop esi
pop edi
ret
mov eax, edi
pop edi
ret
mov eax, edi
pop esi
pop edi
ret

Function at 0x401340
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push str.DISPLAY
mov ebx, eax
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebx + 4]
mov ebp, dword [ebx + 8]
mov edi, eax
mov eax, dword [ebx]
mov ebx, dword [ebx + 0xc]
push 8
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor ecx, ecx
cmp dword [esp + 0x14], ecx
jge 0x40139a
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x10], ecx
jge 0x4013a4
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x18]
cmp ebp, ecx
jle 0x4013ae
mov ebp, ecx
cmp ebx, eax
jle 0x4013b4
mov ebx, eax
sub ebx, dword [esp + 0x10]
sub ebp, dword [esp + 0x14]
push ebx
push ebp
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x10]
push 0xcc0020
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push eax
push esi
push ebx
push ebp
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x18]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, eax
call esi
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x401420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp method.CDialog.virtual_320
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x43a075
cmp dword [edi + 0x54], 0
jne 0x43a075
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00446343
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0043a01c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x4014f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ecx, ecx
xor eax, eax
jmp 0x401500
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x401500
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor bl, bl
lea esp, [esp]
mov eax, ecx
cdq
idiv edi
inc ecx
mov al, byte [edx + ebp]
add al, byte [ecx + esi - 1]
movzx edx, byte [ecx + esi - 1]
add bl, al
movzx eax, bl
add eax, esi
cmp ecx, 0x100
mov byte [esp + 0xb], dl
movzx edx, byte [eax]
mov byte [ecx + esi - 1], dl
movzx edx, byte [esp + 0xb]
mov byte [eax], dl
jl 0x401520
pop ebp
pop ebx
pop ecx
ret

Function at 0x401560
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push edi
mov edi, edx
test ecx, ecx
jle 0x4015de
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
push esi
sub ebp, edi
mov ecx, 1
lea ebx, [ebx]
add byte [eax + 0x100], cl
movzx ecx, byte [eax + 0x100]
movzx edx, byte [ecx + eax]
add byte [eax + 0x101], dl
mov dl, byte [ecx + eax]
lea esi, [ecx + eax]
movzx ecx, byte [eax + 0x101]
mov bl, byte [ecx + eax]
add ecx, eax
mov byte [esi], bl
mov byte [ecx], dl
movzx ecx, byte [eax + 0x101]
movzx ecx, byte [ecx + eax]
movzx edx, byte [eax + 0x100]
add cl, byte [edx + eax]
movzx edx, cl
movzx ecx, byte [edx + eax]
xor cl, byte [edi + ebp]
mov byte [edi], cl
mov ecx, 1
add edi, ecx
sub dword [esp + 0x10], ecx
jne 0x401580
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4015f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
lea ecx, [ebp + 2]
push esi
mov esi, eax
test ecx, ecx
jl 0x401736
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x401736
push ebx
push edi
lea edi, [eax*4 + 1]
push edi
call fcn.0045e255
push edi
mov ebx, eax
push 0
push ebx
call fcn.0045fbe0
add esp, 0x10
cmp ebp, 2
mov ecx, ebx
jle 0x4016be
lea edx, [ebp - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add ebp, eax
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx edi, byte [esi + 1]
and eax, 3
shl eax, 4
shr edi, 4
movzx eax, byte [eax + edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx edi, byte [esi + 2]
inc ecx
and eax, 0xf
shr edi, 6
movzx eax, byte [edi + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x401660
test ebp, ebp
je 0x40171e
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
cmp ebp, 1
jle 0x401704
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
inc ecx
and eax, 0xf
movzx edx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x401719
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40172c
mov edx, ecx
sub edx, ebx
mov dword [eax], edx
pop edi
mov eax, ebx
pop ebx
pop esi
mov byte [ecx], 0
pop ebp
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401744
mov dword [eax], 0
pop esi
xor eax, eax
pop ebp
ret
Function at 0x406210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406229
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406264
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x406260
lea ebx, [ebx]
cmp esi, eax
jae 0x406264
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406250
cmp esi, eax
jb 0x40626a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40ecf0
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor byte [ecx], dl
mov dword [esp], 0
mov eax, ecx
je 0x40ed05
mov edi, edi
inc eax
xor byte [eax], dl
jne 0x40ed00
mov eax, ecx
push edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40ed20
sub eax, edi
push eax
push ecx
mov ecx, esi
call fcn.00401bf0
mov eax, esi
pop edi
pop ecx
ret
Function at 0x40fad0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
cmp edi, esi
jne 0x40fae1
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp dword [0x4b1170], 0
jne 0x40fafd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov dword [0x4b1170], eax
call fcn.0045ee63
jmp 0x40fb1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub eax, dword [0x4b1170]
cmp eax, 0x1e
jbe 0x40fb1f
push ebx
call fcn.0045ee63
mov dword [0x4b1170], ebx
add esp, 4
mov eax, dword [0x4ae234]
test eax, eax
jne 0x40fb61
imul edi, edi, 0x2710
call fcn.0045ee75
mov ebx, eax
call fcn.0045ee75
imul ebx, eax
imul esi, esi, 0x2710
mov eax, ebx
cdq
sub esi, edi
idiv esi
mov eax, 0x68db8bad
add edx, edi
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
pop edi
pop esi
pop ebx
ret
cmp eax, 1
jne 0x40fb79
call fcn.0045ee75
sub esi, edi
cdq
inc esi
idiv esi
mov eax, edx
add eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 2
jne 0x40fb8e
call fcn.0040fa50
sub esi, edi
inc esi
xor edx, edx
div esi
mov eax, edx
add eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x40fba0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
lea eax, [esp + 8]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftwardID
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40fc28
push ebx
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftwardID
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40fc28
mov ebp, 0x10
cmp dword [esp + 0x28], ebp
jb 0x40fbff
mov edx, dword [esp + 0x14]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x40fc22
mov eax, dword [esp + 0x30]
push eax
call fcn.004396bc
add esp, 4
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x30]
mov ebp, 0x10
cmp dword [esp + 0x44], ebp
jae 0x40fc3b
lea edx, [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x40fc4b
lea edi, [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40fc50
mov ecx, dword [esp + 0x10]
sub eax, esi
inc eax
push eax
push edx
push 1
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
test eax, eax
je 0x40fcc4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40fbec
cmp dword [esp + 0x28], ebp
jb 0x40fc97
mov eax, dword [esp + 0x14]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x40fc22
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004396bc
add esp, 4
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x28], ebp
jb 0x40fce2
mov edx, dword [esp + 0x14]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x40fd05
mov eax, dword [esp + 0x30]
push eax
call fcn.004396bc
add esp, 4
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x40fdd0
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x479133
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4947a0]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1ac]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov dword [esp + 0x34], ebp
mov byte [ebp + 4], bl
mov dword [esp + 0x1a4], ebx
mov dl, 0x12
mov cl, 0x13
mov al, 0xd
mov byte [esp + 0x85], dl
mov byte [esp + 0x87], cl
mov byte [esp + 0x88], dl
mov byte [esp + 0x8a], cl
mov dl, 0xe
mov cl, 7
mov byte [esp + 0x82], al
mov byte [esp + 0x83], al
mov byte [esp + 0x8e], al
mov al, 5
mov byte [esp + 0x8b], dl
mov byte [esp + 0x8c], cl
mov byte [esp + 0x75], dl
mov byte [esp + 0x77], cl
mov edi, 1
mov dl, 0x61
lea ecx, [esp + 0x80]
lea esi, [esp + 0x18]
mov dword [esp + 0x14], edi
mov byte [esp + 0x80], 0x44
mov byte [esp + 0x81], 0x20
mov byte [esp + 0x84], 0x34
mov byte [esp + 0x86], 4
mov byte [esp + 0x89], 0x31
mov byte [esp + 0x8d], 8
mov byte [esp + 0x8f], 4
mov byte [esp + 0x90], 0x44
mov byte [esp + 0x91], 0x61
mov byte [esp + 0x70], 0x3d
mov byte [esp + 0x71], 2
mov byte [esp + 0x72], 0xc
mov byte [esp + 0x73], al
mov byte [esp + 0x74], 2
mov byte [esp + 0x76], 0xf
mov byte [esp + 0x78], 0x4f
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], bl
mov byte [esp + 0x7b], 0x15
mov byte [esp + 0x7c], 0x61
call fcn.0040ecf0
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x40ff29
mov eax, dword [eax + 4]
jmp 0x40ff2c
add eax, 4
push 0x104
lea ecx, [esp + 0x98]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [esp + 0x30], esi
jb 0x40ff53
mov edx, dword [esp + 0x1c]
push edx
call fcn.004396bc
add esp, 4
lea eax, [esp + 0x94]
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ff70
sub eax, esi
push eax
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x5c]
call fcn.00401bf0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x5c]
push ecx
mov ecx, ebp
mov dword [esp + 0x1b0], edi
call fcn.00401910
mov dl, 0x61
lea ecx, [esp + 0x70]
lea esi, [esp + 0x38]
call fcn.0040ecf0
push eax
push ebp
lea edi, [esp + 0x20]
mov byte [esp + 0x1ac], 2
call fcn.0040d8e0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, ebp
mov byte [esp + 0x1b0], 3
call fcn.00401910
mov esi, 0x10
cmp dword [esp + 0x30], esi
jb 0x40fff1
mov edx, dword [esp + 0x1c]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x50], esi
jb 0x410014
mov eax, dword [esp + 0x3c]
push eax
call fcn.004396bc
add esp, 4
cmp dword [esp + 0x6c], esi
jb 0x410027
mov ecx, dword [esp + 0x58]
push ecx
call fcn.004396bc
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x194
ret
Function at 0x412340
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push 0x94
lea eax, [esp + 8]
push 0
push eax
call fcn.0045fbe0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4123bc
cmp dword [esp + 8], 5
ja 0x4123a1
xor eax, eax
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x98
ret
mov eax, 1
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x98
ret
mov ecx, dword [esp + 0x98]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0045e1a6
add esp, 0x98
ret

Function at 0x4123e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push edi
xor ebx, ebx
push 0x31
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x1d]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x32
mov byte [esp + 0x24], bl
call fcn.0045fbe0
add esp, 0xc
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x412445
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [esp + 0xc], ebx
jne 0x412457
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftInternet_Explorer
jmp 0x412461
lea eax, [esp + 8]
push eax
push str.SOFTWAREWow6432NodeMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
jne 0x41249b
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4124b0
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00401bf0
mov ecx, dword [esp + 0x4c]
pop edi
pop ebx
xor ecx, esp
mov eax, esi
call fcn.0045e1a6
add esp, 0x48
ret
Function at 0x412740
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
lea eax, [esp + 8]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.AppEventsSchemesAppsExplorerNavigating.Current
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4127ca
push ebx
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppEventsSchemesAppsExplorerNavigating.Current
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4127ca
mov ebp, 0x10
cmp dword [esp + 0x28], ebp
jb 0x41279f
mov edx, dword [esp + 0x14]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x412850
mov eax, dword [esp + 0x30]
push eax
call fcn.004396bc
add esp, 4
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x30]
mov ebp, 0x10
cmp dword [esp + 0x44], ebp
jae 0x4127dd
lea edx, [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4127ed
lea edi, [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4127f2
mov ecx, dword [esp + 0x10]
sub eax, esi
inc eax
push eax
push edx
push 1
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [esp + 0x28], ebp
jb 0x41282d
mov eax, dword [esp + 0x14]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x412850
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004396bc
add esp, 4
pop ebp
pop ebx
pop ecx
ret
Function at 0x412860
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
lea eax, [esp + 8]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.AppEventsSchemesAppsExplorerActivatingDocument.Current
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4128ea
push ebx
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppEventsSchemesAppsExplorerActivatingDocument.Current
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4128ea
mov ebp, 0x10
cmp dword [esp + 0x28], ebp
jb 0x4128bf
mov edx, dword [esp + 0x14]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x412970
mov eax, dword [esp + 0x30]
push eax
call fcn.004396bc
add esp, 4
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x30]
mov ebp, 0x10
cmp dword [esp + 0x44], ebp
jae 0x4128fd
lea edx, [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x41290d
lea edi, [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412912
mov ecx, dword [esp + 0x10]
sub eax, esi
inc eax
push eax
push edx
push 1
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [esp + 0x28], ebp
jb 0x41294d
mov eax, dword [esp + 0x14]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], ebp
jb 0x412970
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004396bc
add esp, 4
pop ebp
pop ebx
pop ecx
ret
Function at 0x412980
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x47757b
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x148], eax
push ebp
push esi
mov eax, dword [0x4947a0]
xor eax, esp
push eax
lea eax, [esp + 0x15c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x16c]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov esi, eax
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0045fbe0
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push esi
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412a7a
lea ebx, [ebx]
cmp dword [esp + 0x34], ebp
je 0x412a17
lea edx, [esp + 0x2c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412a00
jmp 0x412a7a
lea eax, [esp + 0x50]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412a33
sub eax, edx
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
call fcn.00401bf0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esp + 0x170], 0
call fcn.00401910
cmp dword [esp + 0x28], 0x10
jb 0x412a7a
mov edx, dword [esp + 0x14]
push edx
call fcn.004396bc
add esp, 4
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x15c
ret