joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20a6f24
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea eax, [ebp - 8]
push edi
push eax
push 0
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x20a6ff8
mov dword [0x20ab45c], 0x83
jmp 0x20a70b5
xor esi, esi
test esi, esi
je 0x20a6ff3
mov byte [ebp + edi - 0x108], 0
call fcn.020a76cc
push 0x3d
call fcn.020a77f3
test eax, eax
je 0x20a6f80
push 0x20
call fcn.020a77f3
xor edi, edi
lea eax, [ebp - 1]
push eax
call fcn.020a7734
test eax, eax
je 0x20a6fbe
push dword [ebp - 1]
call fcn.020a7841
test eax, eax
jne 0x20a6fbe
cmp edi, 0x3fff
jae 0x20a6fbc
mov al, byte [ebp - 1]
inc edi
lea ecx, [ebp - 1]
mov byte [edi + 0x20ab56f], al
push ecx
call fcn.020a7734
test eax, eax
jne 0x20a6f8f
jmp 0x20a6fbe
xor esi, esi
test esi, esi
je 0x20a6ff3
push edi
lea eax, [ebp - 0x108]
mov byte [edi + 0x20ab570], 0
push 0x20ab570
push 1
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x20a6fef
mov dword [0x20ab45c], 0x84
test esi, esi
jne 0x20a6ff8
call fcn.020a76f3
lea eax, [ebp - 1]
push eax
call fcn.020a7734
test eax, eax
je 0x20a70a3
mov edi, str..classes
call fcn.020a77ec
push 0x5c
call fcn.020a77f3
test eax, eax
jne 0x20a7024
mov edi, dword [str.HKEY_CLASSES_ROOT]
mov esi, 1
mov al, byte [edi]
test al, al
je 0x20a703c
inc edi
push eax
call fcn.020a77f3
test eax, eax
jne 0x20a7029
xor esi, esi
test esi, esi
je 0x20a6fef
push 0x5c
call fcn.020a77f3
mov esi, eax
test esi, esi
je 0x20a6ff3
xor edi, edi
lea eax, [ebp - 1]
push eax
call fcn.020a7734
test eax, eax
je 0x20a6f59
cmp byte [ebp - 1], 0x20
je 0x20a6f59
push dword [ebp - 1]
call fcn.020a7841
test eax, eax
jne 0x20a6f59
cmp edi, 0xff
jae 0x20a6f57
mov al, byte [ebp - 1]
inc edi
lea ecx, [ebp - 1]
mov byte [ebp + edi - 0x109], al
push ecx
call fcn.020a7734
test eax, eax
jne 0x20a7060
jmp 0x20a6f59
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x20a7734
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x200
mov ebp, esp
sub esp, 4
cmp dword [0x20ab444], eax
jne 0x20a77b9
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push 0x20ab240
mov eax, dword [0x20ab440]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x20a7771
mov dword [0x20ab45c], 0x82
xor eax, eax
jmp 0x20a77e6
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [0x20ab444], ecx
mov dword [0x20ab44c], eax
add dword [0x20ab454], eax
cmp dword [0x20ab450], ecx
je 0x20a77a1
mov eax, dword [0x20ab454]
sub edx, edx
div dword [0x20ab450]
cmp eax, 0x64
jbe 0x20a77a6
mov eax, 0x64
cmp eax, dword [0x20ab458]
je 0x20a77b9
push eax
mov dword [0x20ab458], eax
call fcn.020a43c7
mov eax, dword [0x20ab44c]
cmp dword [0x20ab444], eax
mov eax, 0
jge 0x20a77e6
mov eax, dword [0x20ab444]
mov edx, dword [ebp + 8]
mov cl, byte [eax + 0x20ab240]
mov eax, 1
mov byte [edx], cl
inc dword [0x20ab444]
mov esp, ebp
pop ebp
ret 4
Function at 0x20a796d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x5b
xor esi, esi
call fcn.020a7c41
push dword [ebp + 0xc]
call fcn.020a7aef
push 0x20a9728
mov edi, 0x20ab570
call fcn.020a7aef
mov ecx, esi
lea eax, [ebp - 4]
inc esi
push eax
push edi
lea edx, [ebp - 0xc]
push edx
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
mov dword [ebp - 4], 0x4000
push 0
push ebx
push 0x20af590
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test ebx, ebx
jne 0x20a7a47
cmp dword [ebp - 0x10], 0
je 0x20a79dd
push 0x20af590
call fcn.020a7b0d
jmp 0x20a79e4
push 0x40
call fcn.020a7c41
push 0x3d
call fcn.020a7c41
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x20a7a20
cmp eax, 4
je 0x20a7a28
push dword [ebp - 4]
push dword [ebp - 0xc]
push edi
call fcn.020a7b4e
push 0xa
call fcn.020a7c41
cmp dword [0x20ab45c], 0x8d
jne 0x20a7996
jmp 0x20a7ae6
push edi
call fcn.020a7b0d
jmp 0x20a7a04
cmp dword [ebp - 4], 4
jne 0x20a79f8
push str.dword:
call fcn.020a7aef
push 1
mov eax, dword [0x20ab570]
push eax
call fcn.020a7bf6
jmp 0x20a7a04
push 0xa
call fcn.020a7c41
cmp ebx, 0x103
je 0x20a7a60
mov dword [0x20ab45c], 0x8c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp + 0xc]
mov edi, 0x100
add ebx, eax
xor esi, esi
mov byte [ebx], 0x5c
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, eax
mov eax, esi
push edi
inc esi
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x20a7ad5
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x20a7ac9
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.020a796d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x20ab45c], 0x8d
jne 0x20a7a82
jmp 0x20a7ae6
mov dword [0x20ab45c], 0x8b
jmp 0x20a7a82
cmp eax, 0x103
je 0x20a7ae6
mov dword [0x20ab45c], 0x8c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x20a7c8a
Capabilities:
Write file on windows

Disassembly:
sub esp, 4
cmp dword [0x20ab444], 0
je 0x20a7ccd
lea eax, [esp]
push 0
push eax
push dword [0x20ab444]
push 0x20ab240
push dword [0x20ab440]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x20a7cc3
mov eax, dword [0x20ab444]
cmp dword [esp], eax
je 0x20a7ccd
mov dword [0x20ab45c], 0x8d
mov dword [0x20ab444], 0
add esp, 4
ret
Function at 0x20a802c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x5b
xor esi, esi
call fcn.020a81ec
push dword [ebp + 0xc]
call fcn.020a8149
push 0x20a9728
call fcn.020a8149
cmp dword [0x20ab1c0], esi
je 0x20a80d4
mov edi, 0x20ab570
mov ebx, 0x20af590
mov ecx, esi
lea eax, [ebp - 8]
inc esi
push eax
push edi
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 8], 0x4000
push 0
push eax
push ebx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x20a80d4
cmp dword [ebp - 0xc], 0
je 0x20a809f
push ebx
call fcn.020a8149
jmp 0x20a80a6
push 0x40
call fcn.020a81ec
push 0x3d
call fcn.020a81ec
cmp dword [ebp - 0x10], 1
je 0x20a80be
push dword [ebp - 8]
push edi
call fcn.020a816c
jmp 0x20a80c4
push edi
call fcn.020a8149
push 0xa
call fcn.020a81ec
cmp dword [0x20ab1c0], 0
jne 0x20a8062
push 0xa
call fcn.020a81ec
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0xc]
mov ebx, 0x127
add edi, eax
sub ebx, eax
xor esi, esi
mov byte [edi], 0x5c
inc edi
cmp dword [0x20ab1c0], esi
je 0x20a8140
mov eax, esi
push ebx
inc esi
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x20a8140
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x20a8137
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.020a802c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x20ab1c0], 0
jne 0x20a80fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20a83c3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x20ab058], 0
push esi
push edi
je 0x20a8536
mov esi, 1
push esi
mov eax, dword [0x20ab07c]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 4]
lea eax, [ebp - 0x12c]
push ecx
push 0
push ecx
push 0
push eax
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20a844f
inc esi
cmp esi, 0x64
jb 0x20a83e0
mov edi, dword [ebp - 4]
cmp esi, 0x64
jne 0x20a84b0
mov eax, 0xaa
movzx eax, ax
push 0x10
push 0xa8
push eax
push dword [ebp + 8]
push dword [0x20af580]
call fcn.020a6534
add esp, 0x14
jmp 0x20a8536
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x20a848d
cmp eax, 3
je 0x20a849b
cmp eax, 4
je 0x20a849f
mov edi, dword [ebp - 4]
push edi
lea ecx, [ebp - 0x12c]
push 0x20ab570
push dword [ebp + 0xc]
push 0
push ecx
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x20a8420
mov eax, 0xa9
jmp 0x20a842e
mov byte [0x20ab570], 0
mov edi, 1
jmp 0x20a8464
xor edi, edi
jmp 0x20a8464
mov dword [0x20ab570], 0
mov edi, 4
jmp 0x20a8464
lea eax, [ebp - 0x12c]
xor esi, esi
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 3
push esi
push 0x1004
push dword [0x20ab044]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
cmp dword [ebp + 0xc], 1
je 0x20a84f0
cmp dword [ebp + 0xc], 2
je 0x20a84f0
mov dword [ebp - 0x10], 5
jmp 0x20a84f7
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x1007
push dword [0x20ab044]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
mov esi, eax
je 0x20a8536
push dword [ebp + 0xc]
push edi
push 0x20ab570
mov eax, dword [0x20ab044]
push esi
push eax
call fcn.020a8cf7
push esi
mov eax, dword [0x20ab044]
push eax
call fcn.020a8e2e
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x20a855b
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, dword [0x20ab044]
sub esp, 0x134
mov dword [0x20ab19c], eax
mov edx, dword [ebp + 0xc]
push esi
push edi
lea esi, [edx + 0x20]
cmp dword [esi], eax
je 0x20a8656
xor edi, edi
lea eax, [ebp - 0x134]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x34]
push eax
push dword [edx + 0x10]
push 0x102d
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0xc]
push ecx
push edi
push ecx
push edi
push dword [esi]
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x20a85ca
mov eax, 0x4a
jmp 0x20a8632
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push 0x20ab570
mov eax, dword [0x20ab058]
mov dword [ebp - 4], 0x4000
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20a862d
push dword [ebp - 4]
push 0x20ab570
push dword [ebp - 8]
push 0
push dword [esi]
mov eax, dword [0x20ab058]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x20a862d
lea eax, [ebp - 0x134]
push eax
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x20a8656
mov eax, 0x49
movzx eax, ax
lea ecx, [ebp - 0x134]
push ecx
push 0x10
push 0x48
push eax
push dword [ebp + 8]
push dword [0x20af580]
call fcn.020a6534
add esp, 0x18
xor eax, eax
jmp 0x20a865b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x20a8836
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov esi, dword [0x20ab044]
xor edi, edi
push edi
push edi
push 0x1032
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
je 0x20a8871
test eax, eax
je 0x20a89f2
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x20a89f2
push 2
xor ebx, ebx
push 0xffffffffffffffff
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x138]
push ecx
push edi
mov dword [ebp - 0x30], ebx
push 0x102d
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x100
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
jne 0x20a88b3
mov byte [ebp - 0x138], bl
lea eax, [ebp - 0x138]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
mov dword [ebp - 8], 0x4000
mov dword [ebp - 0x10], eax
mov eax, 0x20ab570
push eax
mov dword [ebp - 0xc], eax
push edx
lea eax, [ebp - 0x138]
push 0
push eax
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x20a8909
test edi, edi
jne 0x20a89b3
cmp eax, 2
jne 0x20a89b3
test edi, edi
jne 0x20a891a
mov dword [ebp - 4], 1
test edi, edi
jne 0x20a891a
mov eax, dword [0x20ab064]
mov al, byte [eax]
mov byte [ebp - 0x138], al
mov eax, dword [ebp - 4]
cmp eax, 1
jb 0x20a8934
cmp eax, 2
jbe 0x20a89ba
cmp eax, 4
je 0x20a89c9
mov edx, 0x67
mov eax, entry0
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp + 8]
movzx ecx, dx
push ecx
mov eax, dword [0x20af580]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x20a89f2
test edi, edi
jne 0x20a896a
mov byte [ebp - 0x138], 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
push 0
lea eax, [ebp - 0x138]
push eax
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x20a89e2
mov eax, 0x73
movzx eax, ax
lea ecx, [ebp - 0x138]
push ecx
push 0x10
push 0x70
push eax
push dword [ebp + 8]
push dword [0x20af580]
call fcn.020a6534
add esp, 0x18
jmp 0x20a89f2
mov eax, 0x72
jmp 0x20a8991
mov edx, 0x66
mov eax, 0x20a82bb
jmp 0x20a893e
cmp dword [ebp - 8], 4
jne 0x20a8934
mov edx, 0x6f
mov eax, 0x20a2aa3
jmp 0x20a893e
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push esi
call fcn.020a8cf7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20a89fb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
mov esi, dword [0x20ab044]
xor ebx, ebx
push ebx
push ebx
push 0x1032
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
dec eax
push 0x34
push 0x33
cmp eax, 1
sbb eax, eax
and eax, 2
add eax, 0x32
movzx ecx, ax
push ecx
mov eax, dword [0x20af580]
push dword [ebp + 8]
push eax
call fcn.020a6534
add esp, 0x14
cmp eax, 6
jne 0x20a8b1f
push ebx
push ebx
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
push 2
push dword [ebp - 4]
push 0x100c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
mov edi, eax
je 0x20a8af5
test edi, edi
je 0x20a8aa2
lea eax, [ebp - 0x130]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x28], ebx
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x100
push 0x102d
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x20a8aa8
mov byte [ebp - 0x130], bl
lea eax, [ebp - 0x130]
push eax
push dword [0x20ab058]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x20a8ae6
test edi, edi
je 0x20a8ad3
push ebx
push edi
push 0x1008
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x20a8a60
push 1
push ebx
push ebx
push ebx
push esi
call fcn.020a8cf7
mov dword [ebp - 4], ebx
jmp 0x20a8a60
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
jmp 0x20a8a60
push 0
push 1
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 8], 0
je 0x20a8b1f
push 0x10
push 0x58
push 0x59
push dword [ebp + 8]
push dword [0x20af580]
call fcn.020a6534
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20a8b68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
mov esi, dword [0x20ab044]
push 1
xor ebx, ebx
call fcn.020a4074
push ebx
push ebx
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x1009
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x20ab058], ebx
je 0x20a8cda
lea eax, [ebp - 0x15c]
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or al, 0x10
xor edi, edi
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x38], eax
mov ecx, ebx
lea eax, [ebp - 8]
inc ebx
push eax
push 0x20ab570
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push 0
lea edx, [ebp - 0x15c]
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 8], 0x4000
push eax
push edx
push ecx
mov eax, dword [0x20ab058]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x20a8c61
cmp dword [ebp - 0xc], 0
jne 0x20a8c1c
mov edi, 1
cmp dword [ebp - 4], 1
je 0x20a8c31
cmp dword [ebp - 4], 2
je 0x20a8c31
mov dword [ebp - 0x18], 5
jmp 0x20a8c38
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x34]
push eax
push 0
push 0x1007
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x20ab570
push eax
push esi
call fcn.020a8cf7
jmp 0x20a8bd5
push dword [ebp - 0x38]
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor ecx, ecx
mov eax, dword [0x20ab064]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 4
test edi, edi
je 0x20a8c9f
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x34]
push eax
push ecx
push 0x1006
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x20a8cbd
lea eax, [ebp - 0x34]
xor edi, edi
push eax
push edi
push 0x1007
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push edi
push edi
push edi
push esi
call fcn.020a8cf7
mov eax, 1
lea ecx, [ebp - 0x5c]
push ecx
mov dword [ebp - 0x4c], eax
push 0
mov dword [ebp - 0x50], eax
push 0x102b
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 1
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.020a4074
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x25c67a9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x492521a2
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40ef98
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f035
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f035
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f035
push 4
push 0xffffffffffffffff
push esi
push 0x40f74f
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f035
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f000
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f035
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f03b
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f037

Function at 0x413603
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x413612
pop dword [ebp - 0x18]
mov eax, 0x467fe33b
sub eax, 0x463ead29
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x4242a
push 0
mov eax, 0x3bfde434
add eax, 0xc444dec4
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x45f2
xor edi, edi
add edi, eax
mov esi, 0x7c1084e2
add esi, 0x8434131e
add esi, dword [ebp - 0x18]
mov ebx, 0x22ed9fbb
add ebx, 0xbfa17459
sub dword [ebp - 0xc], 0x9ba23747
mov edx, dword [esi]
add dword [ebp - 8], ebx
sub edx, ebx
mov dword [edi], edx
xor dword [ebp - 0x10], edi
add edi, 0xcfd37981
add edi, 0x302c8683
add esi, 0x91c5a53f
sub esi, 0x91c5a53b
loop 0x41366d
add eax, 0x16b340df
add eax, 0xe94dc9bc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1e09c413
sub ecx, 0x1dc9c413
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x413985
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413995
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x41399b
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x4139c3
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x4139aa
mov esi, ecx
jmp 0x4139c6
movzx esi, si
pop edi
cmp cx, si
je 0x4139e3
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x4139c7
mov eax, 0x437348
jmp 0x4139eb
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x1004c83
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01002df0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1004ce9
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x10062b8]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x1004ced
xor eax, eax
jmp 0x1004cfa
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4023c0
Capabilities:
Encode data using xor

Disassembly:
and byte ds:[edx + 0x4f], 0xf0
pop ebp
rcr byte [ebp + 0x6f], 0x1c
sbb al, 0xc0
lodsb al, byte [esi]
ror dword [edi + 0x64], 1
or byte [edi], al
les ebp, [edx]
sti
mov bh, 0x98
pushal
invalid
Function at 0x3202fdec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x3202fdfb
pop dword [ebp - 0x40]
mov eax, 0x3202fdfb
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x936db3ea
add dword [ebp - 0x50], 0xbae49161
mov dword [ebp - 0x4c], 0xe08b7864
sub dword [ebp - 0x4c], 0xae582c1f
mov dword [ebp - 0x48], 0xaa236fc7
add dword [ebp - 0x48], 0xa228d467
mov dword [ebp - 0x44], 0xf569b4be
add dword [ebp - 0x44], 0xa964b42
lea eax, [ebp - 0x50]
push eax
mov eax, 0x65c6442c
add eax, 0xcc3f0c54
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xccafeca3
add dword [ebp - 0x50], 0xa7c27cb3
mov dword [ebp - 0x4c], 0xf9ddb0e8
sub dword [ebp - 0x4c], 0xb8714f73
mov dword [ebp - 0x48], 0x1e69d2c3
add dword [ebp - 0x48], 0x450599a9
mov dword [ebp - 0x44], 0x3f2cf7d9
add dword [ebp - 0x44], 0xc0d30827
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x49682
push 0
call eax
mov ecx, 0x4e89
xor edx, edx
add edx, eax
mov ebx, 0x3207d600
add ebx, dword [ebp - 0x40]
mov edi, 0xb4c97f80
mov dword [ebp - 0x14], 0xd012b678
mov esi, dword [ebx]
sub dword [ebp - 4], 0x855d11d3
xor esi, edi
xor dword [ebp - 0x1c], edx
mov dword [edx], esi
sub dword [ebp - 0x28], 0x914c447d
add edx, 0xba27ac38
add edx, 0x45d853cc
add ebx, 0xc7148cb9
add ebx, 0x38eb734b
loop 0x3202ff03
add eax, 0x12cf7
mov ebx, eax
add eax, 0x63ce1c4b
add eax, 0x9c31e3ba
mov ecx, 0xac9cc6be
add ecx, 0x85633942
add ecx, dword [ebp - 0x40]
call ebx
leave
ret