joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4846a0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004a7dd0
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x4846cc
cmp ecx, 0x61
jne 0x48472e
cmp word [edx + 2], bx
jne 0x48472e
cmp word [edi], bx
jne 0x48472e
cmp word [eax], bx
jne 0x48472e
cmp word [esi], bx
jne 0x48472e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x48470f
cmp byte [ebp + 0xea], bl
jne 0x48470f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48470d
push esi
call fcn.004852f0
add esp, 4
test al, al
je 0x48470f
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x484722
cmp esi, ebx
je 0x484722
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x484753
cmp word [edi], bx
jne 0x484753
cmp word [eax], bx
jne 0x484753
cmp word [esi], bx
jne 0x484753
mov eax, ebp
call fcn.004848a0
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4b0cf8
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.00485450
test eax, eax
je 0x484854
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
je 0x484860
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x48482c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x484854
cmp byte [ebp + 0xea], bl
jne 0x484825
mov esi, dword [esp + 0x102c]
call fcn.00485360
cmp al, bl
jne 0x484825
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x484854
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x484845
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.004858b0
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00485970
test eax, eax
jne 0x484870
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x484920
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x48488a
cmp eax, ebx
je 0x48488a
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x4858b0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x48596e
mov eax, dword [esi]
test eax, eax
je 0x48596e
push edi
test al, 1
jne 0x4858da
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4858f6
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4858f6
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x485911
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x48594f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x48594f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.0045bb50
add esp, 4
test eax, eax
jne 0x48594f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x48596e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x4861b0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.004a7dd0
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x48625d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x4869d0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4b0cf8
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x48625d
mov ecx, dword [0x4d5b14]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x48625d
push 1
push eax
call fcn.004014c0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x486270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x48628c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4d5b14]
push eax
push esi
mov ecx, edi
call fcn.004867d0
cmp byte [edi], 0
je 0x4862bf
test eax, eax
jne 0x4862c7
mov edx, dword [esp + 0x1c]
push eax
push edx
push edi
call fcn.004863a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x486368
test esi, esi
je 0x486342
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004014c0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x486325
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x486325
push 1
push 0x8000012f
call fcn.004014c0
add esp, 8
push esi
call edi
test eax, eax
jne 0x486300
mov edx, dword [0x4d5b14]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x48633e
push 1
push eax
call fcn.004014c0
add esp, 8
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x486382
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x486368
mov ecx, dword [0x4d5b14]
push ecx
push eax
mov ecx, edi
call fcn.004867d0
test eax, eax
jne 0x48627f
cmp byte [edi], 0
je 0x486382
mov edx, dword [esp + 0x1c]
push 0
push edx
push edi
call fcn.004863a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x1c]
push eax
mov ecx, edi
call fcn.004865a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4863a0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004a7dd0
mov eax, dword [esp + 0x11c74]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x4863c4
mov dword [eax], edi
cmp dword [ebp + 8], edi
je 0x486564
mov cl, 1
mov eax, ebp
call fcn.00486740
test eax, eax
je 0x48658a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4d5b14]
push eax
push esi
mov ecx, ebp
call fcn.004867d0
test eax, eax
setne cl
mov byte [esp + 0x17], cl
test cl, cl
jne 0x48640a
xor eax, eax
mov dword [0x4da698], eax
jmp 0x48640f
mov eax, dword [0x4da698]
cmp byte [esp + 0x11c80], 0
mov dword [esp + 0x1844], edi
mov dword [esp + 0x1848], edi
mov dword [esp + 0x184c], edi
mov dword [esp + 0x1858], edi
mov dword [esp + 0x1864], edi
mov dword [esp + 0x1868], edi
je 0x48644f
mov byte [esp + 0x1841], 0
test cl, cl
je 0x486457
mov byte [esp + 0x1841], 1
mov edx, dword [0x4da694]
mov ecx, 0x4b0cf8
mov dword [esp + 0x1024], ecx
mov dword [esp + 0x102c], ecx
mov dword [esp + 0x1030], ecx
mov ecx, dword [0x4d5b14]
cmp eax, edi
mov dword [esp + 0x1028], edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1850], edx
mov dword [esp + 0x1854], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x103c], ebp
mov dword [esp + 0x18], 0x10
setg bl
cmp byte [esp + 0x17], 0
je 0x4864da
xor ecx, ecx
test eax, eax
jle 0x4864ca
lea ecx, [ecx]
cmp dword [edx + ecx*4], esi
je 0x4864da
inc ecx
cmp ecx, eax
jl 0x4864c0
cmp eax, 0x1f4
jge 0x4864da
mov dword [edx + eax*4], esi
inc eax
mov dword [0x4da698], eax
lea edx, [esp + 0x18]
push edx
push 0x484920
mov dword [esp + 0x185c], eax
call edi
mov eax, dword [esp + 0x1848]
test eax, eax
jne 0x48650b
test bl, bl
je 0x486576
mov edx, dword [0x4da694]
mov dword [0x4da698], eax
xor bl, bl
jmp 0x4864b0
call fcn.00484160
mov ecx, dword [0x4da698]
mov edx, dword [esp + 0x1848]
mov esi, dword [0x4da694]
xor eax, eax
test ecx, ecx
jle 0x48653a
lea esp, [esp]
cmp dword [esi + eax*4], edx
je 0x48654c
inc eax
cmp eax, ecx
jl 0x486530
cmp ecx, 0x1f4
jge 0x48654c
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4da698], ecx
mov eax, dword [0x4d5b14]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x486564
push 1
push eax
call fcn.004014c0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 0xc
mov ecx, dword [esp + 0x11c84]
test ecx, ecx
je 0x48658a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48658a
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c68
ret 0xc
Function at 0x4865a0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004a7dd0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x486720
xor cl, cl
mov eax, edi
call fcn.00486740
test eax, eax
jne 0x4865d5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4d5b14]
push eax
push ebp
mov ecx, edi
call fcn.004867d0
test eax, eax
je 0x4865f8
xor eax, eax
mov dword [0x4da698], eax
jmp 0x4865fd
mov eax, dword [0x4da698]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4b0cf8
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x486643
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x48664b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4da694]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x4868a0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x4866f8
lea ecx, [esp + 0x10]
push ecx
push 0x4851c0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x4866b5
mov edx, dword [esp + 0x1848]
call fcn.00485e40
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.00484160
mov edx, dword [esp + 0x1848]
call fcn.00485e40
mov edx, dword [0x4d5b14]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x486720
push 1
push eax
call fcn.004014c0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4da698]
cmp eax, ebx
je 0x486720
cmp eax, 1
setg al
mov dword [0x4da698], ebx
cmp al, bl
je 0x486720
mov edx, ebp
call fcn.00485e40
push ebx
mov ecx, edi
call fcn.004865a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4a1856
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4b20]
jne 0x4a1860
repz ret
jmp fcn.004a7ae3

Function at 0x4a5040
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d4b20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0049ddb2
and dword [ebp - 0x14], 0
cmp dword [0x4d7e5c], 0
mov dword [ebp - 0x18], eax
jne 0x4a50f3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a519b
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4af0e0
push ebx
call edi
test eax, eax
je 0x4a519b
mov esi, dword [fcn.00499940]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4d7e5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d7e60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d7e64], eax
call edi
push eax
call esi
mov dword [0x4d7e6c], eax
test eax, eax
je 0x4a50f3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d7e68], eax
mov eax, dword [0x4d7e68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00499944]
cmp eax, ecx
je 0x4a514c
cmp dword [0x4d7e6c], ecx
je 0x4a514c
push eax
call esi
push dword [0x4d7e6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a514c
test ebx, ebx
je 0x4a514c
call edi
test eax, eax
je 0x4a5143
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a5143
test byte [ebp - 8], 1
jne 0x4a514c
or dword [ebp + 0x10], 0x200000
jmp 0x4a517f
mov eax, dword [0x4d7e60]
cmp eax, dword [ebp - 0x18]
je 0x4a517f
push eax
call esi
test eax, eax
je 0x4a517f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a517f
mov eax, dword [0x4d7e64]
cmp eax, dword [ebp - 0x18]
je 0x4a517f
push eax
call esi
test eax, eax
je 0x4a517f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d7e5c]
call esi
test eax, eax
je 0x4a519b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a519d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1856
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406120
Capabilities:
Enumerate disk volumes
Get common file path

Disassembly:
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40614a
cmp byte [esi + eax - 1], 0x5c
jne 0x40613c
mov byte [esi + eax - 1], 0
mov ecx, esi
call fcn.00405f10
cmp al, 1
jne 0x40614a
mov al, 1
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x406187
cmp byte [esi + eax - 1], 0x5c
jne 0x406166
mov byte [esi + eax - 1], 0
mov ecx, 0x103
push str.Temp
sub ecx, eax
push ecx
push esi
call fcn.0040ef9d
add esp, 0xc
mov ecx, esi
call fcn.00405f10
cmp al, 1
je 0x406147
push ebx
push ebp
push edi
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4061ef
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push 0x104
push esi
call fcn.0040ef46
mov edi, eax
add esp, 8
cmp edi, 4
jbe 0x4061db
push esi
mov edx, edi
call fcn.00406080
test al, al
je 0x4061db
cmp byte [esi + edi - 1], 0x5c
jne 0x4061d0
mov byte [esi + edi - 1], 0
mov ecx, esi
call fcn.00405f10
cmp al, 1
je 0x406224
push 0x104
push esi
push ebp
call ebx
test eax, eax
jne 0x4061a3
push ebp
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40621e
push 0x5c
push esi
call fcn.0040ef70
add esp, 8
test eax, eax
je 0x40621e
mov ecx, esi
mov byte [eax], 0
call fcn.00405f10
cmp al, 1
je 0x40622b
pop edi
pop ebp
xor al, al
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
pop edi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x409540
Capabilities:
Get file size
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ecx
cmp dword [esi + 0x14], 0
je 0x409560
mov ecx, dword [esi + 0xc]
push 4
lea eax, [esi + 0x1c]
push eax
push 4
push 0
push str.LogLevel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esi + 0x20]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x409633
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [esi + 0x18]
cmp edi, eax
jbe 0x409628
sub edi, eax
cmp edi, 0x200000
jae 0x409628
push ebx
push 0
push 0
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x409627
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409619
push str._SetupApi_log_begin_
xor ecx, ecx
mov edx, esi
call fcn.00409640
mov ecx, dword [esp + 8]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str._SetupApi_log_end_
xor ecx, ecx
mov edx, esi
call fcn.00409640
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop ebx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ecx
ret

Function at 0x4096b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x409730
test esi, esi
je 0x409730
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4096d2
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
mov edx, dword [edi + 4]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
call esi
test eax, eax
je 0x409730
test ebx, ebx
je 0x40971c
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409700
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
mov edx, dword [edi + 4]
push eax
push ebx
push edx
call esi
test eax, eax
je 0x409730
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x41e8e8
push ecx
call esi
pop esi
pop ecx
ret

Function at 0x40e340
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4212d0]
jne 0x40e34a
repz ret
jmp fcn.0040f826
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x27472919
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x26d8797b
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401020
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [eax]
mov dword [ebp - 0x14], eax
movzx eax, word [edi]
test ax, 0xffdf
je 0x4011fc
cmp ax, 9
je 0x4011fc
mov dword [ebp - 0x18], 0
xor ebx, ebx
xor esi, esi
cmp ax, 0x5c
je 0x40109a
lea esi, [esi]
lea esi, [esi]
cmp ax, 0x22
je 0x401190
xor esi, esi
lea edx, [ebx + 1]
movzx eax, word [edi + edx*2]
test ax, ax
je 0x4010a9
cmp ax, 9
sete byte [ebp - 0xd]
cmp ax, 0x20
sete cl
or cl, byte [ebp - 0xd]
je 0x401092
test byte [ebp - 0x18], 1
je 0x4010a9
mov ebx, edx
cmp ax, 0x5c
jne 0x401060
lea edx, [ebx + 1]
add esi, 1
movzx eax, word [edi + edx*2]
test ax, ax
jne 0x401078
lea edx, [ebx + ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x40117f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
movzx edx, word [eax]
test dx, 0xffdf
je 0x401206
cmp dx, 9
je 0x401206
mov dword [ebp - 0x18], 0
xor edi, edi
lea esi, [esi]
add eax, 2
cmp dx, 0x5c
je 0x4011a8
cmp dx, 0x22
je 0x4011c0
mov word [ecx], dx
xor edi, edi
add ecx, 2
movzx edx, word [eax]
test dx, dx
je 0x401149
cmp dx, 9
sete byte [ebp - 0xd]
cmp dx, 0x20
sete bl
or bl, byte [ebp - 0xd]
je 0x401108
test byte [ebp - 0x18], 1
jne 0x401108
mov edi, dword [ebp - 0x14]
xor edx, edx
mov word [ecx], dx
mov dword [edi], eax
movzx edx, word [eax]
cmp dx, 9
je 0x401162
cmp dx, 0x20
jne 0x40117f
add eax, 2
lea esi, [esi]
mov edi, dword [ebp - 0x14]
mov dword [edi], eax
movzx edx, word [eax]
add eax, 2
cmp dx, 9
je 0x401168
cmp dx, 0x20
je 0x401168
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
and esi, 1
jne 0x40106a
xor dword [ebp - 0x18], 1
jmp 0x40106c
mov esi, 0x5c
add edi, 1
add ecx, 2
mov word [ecx - 2], si
jmp 0x401127
mov edx, edi
sar edx, 1
and edi, 1
jne 0x4011e0
add edx, edx
xor dword [ebp - 0x18], 1
xor edi, edi
sub ecx, edx
jmp 0x401127
mov ebx, 0x7fffffff
xor edi, edi
sub ebx, edx
lea edx, [ecx + ebx*2]
mov ebx, 0x22
mov word [edx], bx
lea ecx, [edx + 2]
jmp 0x401127
mov edx, 2
jmp 0x4010ad
mov ecx, dword [ebp - 0x1c]
jmp 0x401149
Function at 0x402500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402558
cmp byte [esi + ebx - 1], 0xa
je 0x40252c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret