joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aac9e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4aacd6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a8cbf
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a8c97
jmp 0x4aace2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ac513
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ac555
call fcn.004b2cfd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ac555
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ac54c
xor eax, eax
jmp 0x4ac55d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ac563
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b322d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b325b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b3279
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b3193
jmp 0x4b3279
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b3279
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b3193
test edi, edi
mov eax, edi
jne 0x4b3263
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4b5b1a
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4b5b42
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4b5b53
push 2
call edi
test ax, ax
jge 0x4b5b53
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004aa2d3
cmp dword [esi + 0x30], ebx
jne 0x4b5c2d
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, pe_nt_image_headers32
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.004aa2d3
cmp eax, dword [esp + 0x34]
jne 0x4b5c2d
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4b5bc9
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4b5c0e
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4b5c2d
cmp eax, 0x205
je 0x4b5c2d
cmp eax, 0x201
je 0x4b5c2d
cmp eax, 0x204
je 0x4b5c2d
cmp eax, ebx
jne 0x4b5bf4
cmp dword [esp + 0x1c], 0x1b
je 0x4b5c2d
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x636cd4]
jbe 0x4b5c23
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4b5b86
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x7f32c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7f32ce
pushal
call 0x7f32d4
pop ebp
sub ebp, 0x10
sub ebp, 0x3f32c4
jmp 0x7f32ea
mov eax, 0x3f32c4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f0
mov edx, 0xe6a90af
xor byte [eax], dl
inc eax
dec ecx
jne 0x7f3301
jmp 0x7f3314
and al, 0x62
and al, 0x26
xchg ebx, eax
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
outsb dx, byte cs:[esi]
push edi
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
lodsb al, byte [esi]
bound edx, qword [edi]
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
adc eax, 0xafafaf87
pop eax
dec ebp
lodsb al, byte [esi]
and al, 0x2e
mov dword [0xacafafaf], eax
push 0x22
retf
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x450090]
jne 0x401abf
repz ret
jmp fcn.00402ab8

Function at 0x408fde
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004073a9
and dword [ebp - 4], 0
cmp dword [0x4545cc], 0
mov ebx, eax
jne 0x40908f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409140
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409140
push eax
call fcn.00407337
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4545cc], eax
call esi
push eax
call fcn.00407337
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4545d0], eax
call esi
push eax
call fcn.00407337
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4545d4], eax
call esi
push eax
call fcn.00407337
pop ecx
mov dword [0x4545dc], eax
test eax, eax
je 0x40908f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407337
pop ecx
mov dword [0x4545d8], eax
mov eax, dword [0x4545d8]
cmp eax, ebx
je 0x4090e7
cmp dword [0x4545dc], ebx
je 0x4090e7
push eax
call fcn.004073b2
push dword [0x4545dc]
mov esi, eax
call fcn.004073b2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4090e7
test edi, edi
je 0x4090e7
call esi
test eax, eax
je 0x4090de
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4090de
test byte [ebp - 0xc], 1
jne 0x4090e7
or dword [ebp + 0x10], 0x200000
jmp 0x409120
mov eax, dword [0x4545d0]
cmp eax, ebx
je 0x409120
push eax
call fcn.004073b2
pop ecx
test eax, eax
je 0x409120
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409120
mov eax, dword [0x4545d4]
cmp eax, ebx
je 0x409120
push eax
call fcn.004073b2
pop ecx
test eax, eax
je 0x409120
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4545cc]
call fcn.004073b2
pop ecx
test eax, eax
je 0x409140
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409142
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10008c4f
pop dword [ebp - 0x28]
mov eax, 0xeb162bca
add eax, 0x24ea6085
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x381ab
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4bde
xor esi, esi
add esi, eax
mov edi, 0x10019800
add edi, dword [ebp - 0x28]
mov edx, 0x336e6880
add dword [ebp - 0x10], edx
mov ebx, dword [edi]
xor dword [ebp - 0x1c], edi
sub ebx, edx
add dword [ebp - 8], 0x61177c92
mov dword [esi], ebx
xor dword [ebp - 8], ecx
add esi, 0xd7706e46
add esi, 0x288f91be
add edi, 0x65dd4547
add edi, 0x9a22babd
loop 0x10008c99
add eax, 0x1224b
xor ebx, ebx
add ebx, eax
add eax, 0x151146a3
add eax, 0xeaeeb962
mov ecx, 0x70a67bcd
sub ecx, 0x60a67bcd
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1002ebed
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x1004aef9
call fcn.10046f54
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
call fcn.1003f5ed
xor eax, eax
mov esi, 0x800
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, eax
mov dword [ebp - 0x24], eax
push 0x1002
mov byte [ebp - 4], 1
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x50]
call fcn.10039839
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.10039839
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x1002ed6e
push 0x100057b0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x50]
push 0x100057d0
call fcn.10039839
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push dword [ebp - 0x4c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002ed43
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push eax
push edi
push 0x100057e0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ed43
cmp dword [ebp - 0x2c], eax
jbe 0x1002ed43
mov edx, dword [ebp - 0x4c]
mov ecx, 0x1000580c
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x1002ed03
test si, si
je 0x1002ecff
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x1002ed03
add eax, 4
add ecx, 4
test si, si
jne 0x1002ecdd
xor eax, eax
jmp 0x1002ed08
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002ed40
mov eax, 0x10005818
mov cx, word [edx]
cmp cx, word [eax]
jne 0x1002ed37
test cx, cx
je 0x1002ed33
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x1002ed37
add edx, 4
add eax, 4
test cx, cx
jne 0x1002ed11
xor eax, eax
jmp 0x1002ed3c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002ed43
xor edi, edi
inc edi
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
js 0x1002ed6e
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
push 0x1000837c
push 7
push 0
push eax
call fcn.10039839
mov esi, eax
cmp dword [ebp - 0x28], 0
je 0x1002ed7d
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jns 0x1002ed95
push ebx
push esi
push 0x7d6
push 0x89f
call fcn.1003d19b
add esp, 0x10
cmp dword [ebp - 0x24], 0
je 0x1002eda8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1003f607
mov eax, esi
call fcn.10046fd7
ret 8
Function at 0x10039839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10039848
pop dword [ebp - 0x10]
mov eax, 0x10039848
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x98e423b3
sub dword [ebp - 0x20], 0x4a91de68
mov dword [ebp - 0x1c], 0xd7e3d21c
add dword [ebp - 0x1c], 0x5a4f7a29
mov dword [ebp - 0x18], 0xc1537a8f
add dword [ebp - 0x18], 0x8af8c99f
mov dword [ebp - 0x14], 0xe26996be
sub dword [ebp - 0x14], 0xe26996be
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x921d4c7a
sub dword [ebp - 0x20], 0x1daae324
mov dword [ebp - 0x1c], 0xfe87153e
add dword [ebp - 0x1c], 0x42e54c37
mov dword [ebp - 0x18], 0xe09e2fd3
sub dword [ebp - 0x18], 0x7d2ec367
mov dword [ebp - 0x14], 0x189eb506
add dword [ebp - 0x14], 0xe7614afa
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x18278f8f
add eax, 0xf7d88091
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3e5a2
push 0
call eax
mov ecx, 0x454e
xor esi, esi
add esi, eax
mov edi, 0x10072600
add edi, dword [ebp - 0x10]
mov edx, 0xfe0b29bc
sub edx, 0x97d3c1be
xor dword [ebp - 8], 0x60f60fe6
mov ebx, dword [edi]
mov dword [ebp - 4], 0xb73f234a
xor ebx, edx
sub dword [ebp - 4], edi
mov dword [esi], ebx
mov dword [ebp - 8], 0x272c57a6
add esi, 4
add edi, 0x61b3dda4
add edi, 0x9e4c2260
loop 0x10039956
add eax, 0xa25e366f
add eax, 0x5da2d19c
mov ebx, eax
add eax, 5
mov ecx, 0x8c84c33
sub ecx, 0xf8c84c33
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1004413c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 2
jne 0x10044161
cmp dword [esi + 0x20], 0
je 0x10044161
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [esi + 0x20]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
and dword [esi + 0x20], 0
pop ecx
xor eax, eax
pop esi
ret
Function at 0x10046306
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009e0c]
jne 0x10047305
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10057d38], eax
mov dword [0x10057d34], ecx
mov dword [0x10057d30], edx
mov dword [0x10057d2c], ebx
mov dword [0x10057d28], esi
mov dword [0x10057d24], edi
mov word [0x10057d50], ss
mov word [0x10057d44], cs
mov word [0x10057d20], ds
mov word [0x10057d1c], es
mov word [0x10057d18], fs
mov word [0x10057d14], gs
pushfd
pop dword [0x10057d48]
mov eax, dword [ebp]
mov dword [0x10057d3c], eax
mov eax, dword [ebp + 4]
mov dword [0x10057d40], eax
lea eax, [ebp + 8]
mov dword [0x10057d4c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10057c88], 0x10001
mov eax, dword [0x10057d40]
mov dword [0x10057c3c], eax
mov dword [0x10057c30], 0xc0000409
mov dword [0x10057c34], 1
mov eax, dword [0x10009e0c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10057ab0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10057c80], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000a00c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10057c80], 0
jne 0x100473f1
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x292a1cfa
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xbbc224d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409565
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4095a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4095a0
lea ebx, [ebx]
cmp esi, edx
jae 0x4095a4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x409590
cmp esi, edx
jb 0x4095a9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40aca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ad11
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40acdf
cmp eax, 2
jne 0x40acfb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40ad0b
test ecx, ecx
je 0x40ad06
test cl, 1
jne 0x40acfb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40ad0b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40b700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x40b715
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x40b720
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b720
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40be70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x559680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x1b4], edi
mov dword [ebp - 0x1b8], eax
call fcn.0040c0e0
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1b0], eax
test ebx, ebx
je 0x40c054
test edi, edi
je 0x40c054
cmp eax, dword [ebp + 0x14]
ja 0x40c054
xor ecx, ecx
test esi, esi
je 0x40bf67
cmp ecx, esi
jae 0x40bedb
movzx edx, byte [ecx + ebx]
inc ecx
jmp 0x40bedd
xor edx, edx
cmp ecx, esi
jae 0x40beee
movzx eax, byte [ecx + ebx]
mov dword [ebp - 0x1ac], eax
inc ecx
jmp 0x40bef8
mov dword [ebp - 0x1ac], 0
cmp ecx, esi
jae 0x40bf03
movzx eax, byte [ecx + ebx]
inc ecx
jmp 0x40bf05
xor eax, eax
shl edx, 8
add edx, dword [ebp - 0x1ac]
add edi, 4
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 4], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 3], al
mov eax, edx
shr eax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 2], al
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 1], al
cmp ecx, esi
jb 0x40bed4
mov edi, dword [ebp - 0x1b4]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
xor ecx, ecx
lea eax, [edx + edx*2]
mov edx, dword [ebp - 0x1b0]
sub esi, eax
cmp dword [esi*4 + 0x50e720], ecx
jle 0x40bfa0
lea eax, [edx - 1]
add eax, edi
jmp 0x40bf90
mov byte [eax], 0x3d
inc ecx
lea eax, [eax - 1]
cmp ecx, dword [esi*4 + 0x50e720]
jl 0x40bf90
mov eax, dword [ebp - 0x1b8]
mov esi, 0x12
mov dword [eax], edx
mov ecx, dword [0x55aac0]
lea edx, [ecx + 1]
lea eax, [ecx + 2]
imul eax, edx
imul eax, ecx
cdq
idiv esi
cmp edx, 0xf
jne 0x40c041
xor ebx, ebx
lea eax, [ebp - 0x1a8]
nop
xor edx, edx
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x1ac], eax
mov edi, edi
lea edi, [edx + 1]
mov eax, ecx
cdq
lea esi, [ebx + 1]
idiv esi
mov eax, ecx
sub eax, ebx
mov esi, edx
imul esi, eax
mov eax, ecx
cdq
idiv edi
add esi, eax
sub esi, dword [ebp - 0x1b0]
push esi
push 0x50e71c
call fcn.004e09e9
mov eax, dword [ebp - 0x1ac]
mov edx, edi
add eax, 4
add esp, 8
mov dword [ebp - 0x1b0], edi
mov dword [ebp - 0x1ac], eax
cmp edx, 7
jge 0x40c033
mov ecx, dword [0x55aac0]
jmp 0x40bfe0
inc ebx
cmp ebx, 0xf
jge 0x40c041
mov ecx, dword [0x55aac0]
jmp 0x40bfd0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
Function at 0x40c270
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c2ca
push 5
push str.tempo
push 1
push str.Tempo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
jne 0x40c2c1
push str.Tempo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x559680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 8], ax
push edi
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x5f005f
mov dword [ebp - 0x44], 0x520043
mov dword [ebp - 0x40], 0x40005f
mov dword [ebp - 0x3c], 0x410046
mov dword [ebp - 0x38], 0x4c0049
mov dword [ebp - 0x34], 0x440045
mov dword [ebp - 0x30], 0x44005f
mov dword [ebp - 0x2c], 0x57004f
mov dword [ebp - 0x28], 0x4c004e
mov dword [ebp - 0x24], 0x41004f
mov dword [ebp - 0x20], 0x5f0044
mov dword [ebp - 0x1c], 0x450052
mov dword [ebp - 0x18], 0x440041
mov dword [ebp - 0x14], 0x5f0040
mov dword [ebp - 0x10], 0x520043
mov dword [ebp - 0xc], 0x5f005f
call fcn.00401b70
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004df4f4
mov esp, ebp
pop ebp
ret

Function at 0x40c400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c41b
test al, 0x10
je 0x40c41b
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x40c510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c400
add esp, 4
test al, al
jne 0x40c543
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c543
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
pop esi
pop ebp
ret
mov al, 1
pop esi
pop ebp
ret

Function at 0x40c9b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c9d8
xor eax, eax
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ebp
ret