joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f14
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
mov eax, dword [ebp + 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x405fe8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41a6b4
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41a6b8], eax
cmp dword [ebp + 8], 0
jne 0x405f81
lea eax, [ebp + 8]
mov edx, 0x406000
call fcn.004032a0
mov eax, dword [ebp + 8]
call fcn.0040338c
push eax
lea eax, [ebp + 8]
call fcn.004035dc
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fef
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
lea eax, [ebp + 8]
call fcn.00403208
ret

Function at 0x406004
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x4060a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41a6b4
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41a6b8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret

Function at 0x406144
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x4061d3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406184
lea eax, [ebp - 8]
mov edx, 0x4061ec
call fcn.004032a0
mov eax, dword [ebp - 8]
call fcn.0040338c
push eax
lea eax, [ebp - 8]
call fcn.004035dc
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061da
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret
Function at 0x4061f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x406253
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40625a
lea eax, [ebp - 4]
call fcn.00403208
ret

Function at 0x406264
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x4062fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41a6b4
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6b8], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406301
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret

Function at 0x40692c
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4190d4], 0
jne 0x4069fe
mov byte [0x4190d4], 1
xor eax, eax
mov dword [0x4190cc], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x406974
cmp dword [esp + 0x1c], 3
jne 0x4069d4
cmp dword [esp + 0x20], 0x33
jbe 0x4069d4
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x406a08
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4069fe
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x406a38
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4069fe
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x4069fe
cmp byte [esp + 9], 0
jne 0x4069fe
jmp 0x4069e9
push 0
push 0x406a38
push 0x406a40
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x4069fe
mov eax, dword [0x4190c8]
call fcn.0040358c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4190cc], eax
add esp, 0xac
ret
Function at 0x409be0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x409be8
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x409e23
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x409e08
mov dword [ebp - 0xc], 0x7e0
mov eax, 0x41ab68
mov edx, 0x409e3c
call fcn.0040325c
mov eax, dword [ebp - 0xc]
call fcn.00402490
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004027e8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x409c6c
cmp eax, 0xea
jne 0x409de2
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x409c44
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x409c8e
lea eax, [esi + edi*8]
invalid
push edx

Function at 0x40afac
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
mov eax, dword [0x41ade8]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41ab68
mov edx, 0x40b024
call fcn.0040325c
push 0
push 0
mov eax, dword [0x41adec]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
mov eax, dword [0x41adf0]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41ab68
mov edx, 0x40b0c0
call fcn.0040325c
ret
Function at 0x40d148
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x40d31d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.004026c0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00404964
mov edx, dword [ebp - 4]
mov eax, 0x41ab40
call fcn.0040325c
cmp byte [0x41aba9], 0
jne 0x40d1a6
mov eax, dword [0x41ab40]
push eax
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405f14
cmp byte [0x41aba9], 0
je 0x40d1b9
call fcn.0040d520
jmp 0x40d302
xor ebx, ebx
push 0
mov eax, dword [0x41ae1c]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x40d1df
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x40d1bb
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x40d32c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
mov eax, 0x41ab68
mov edx, 0x40d33c
call fcn.0040325c
mov eax, dword [0x41acfc]
call fcn.0040358c
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x40d231
mov eax, dword [0x41ad04]
call fcn.0040358c
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x40d2bb
mov eax, dword [0x41ae20]
call fcn.0040358c
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov esi, eax
mov eax, 0x41ab68
mov edx, 0x40d3a8
call fcn.0040325c
test esi, esi
je 0x40d2bb
call esi
mov eax, 0x41ab68
mov edx, 0x40d41c
call fcn.0040325c
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x4191c8
mov edx, 5
call fcn.00416354
mov eax, 0x41ab68
mov edx, 0x40d470
call fcn.0040325c
mov eax, dword [0x41ad10]
call fcn.0040358c
mov edx, eax
mov eax, 0x41abbc
mov ecx, 0xbb8
call fcn.00405c88
test al, al
je 0x40d302
call fcn.0040d520
call fcn.0040ff84
mov eax, 0x41ab68
mov edx, 0x40d48c
call fcn.0040325c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d324
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret
Function at 0x40fd78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x40fe60
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x41abb0], 0
jne 0x40fdaa
call fcn.0040fc74
push 2
push 0
push 0
mov eax, dword [0x41abb0]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x40fdc5
call fcn.0040fc74
mov eax, 0x41ab68
mov edx, 0x40fe78
call fcn.0040325c
lea edx, [ebp - 0xc]
mov al, byte [0x41abaa]
call fcn.004049a0
push dword [ebp - 0xc]
push 0x40ff00
push dword [ebp - 4]
push 0x40ff0c
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x40ff18
call fcn.0040325c
mov byte [0x41abaa], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040338c
push eax
lea eax, [ebp - 4]
call fcn.004035dc
push eax
mov eax, dword [0x41abb0]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x40fe42
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fe67
lea eax, [ebp - 0xc]
call fcn.00403208
lea eax, [ebp - 4]
call fcn.00403208
ret

Function at 0x4101bc
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcc
push 0
push 0
dec ecx
jne 0x4101c4
push ebx
push esi
push edi
mov edi, 0x41ab78
mov ebx, dword [0x4192d4]
xor eax, eax
push ebp
push 0x4116bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4116d4
call fcn.0040325c
mov dword [ebp - 0xdc], 0x94
mov eax, 0x41ab68
mov edx, 0x4116e0
call fcn.0040325c
lea eax, [ebp - 0xdc]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xcc]
cmp esi, 2
jne 0x410232
lea eax, [ebp - 8]
mov edx, 0x4116f8
call fcn.004032a0
jmp 0x410256
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b4]
call fcn.00404900
mov ecx, dword [ebp - 0x5b4]
lea eax, [ebp - 8]
mov edx, 0x411704
call fcn.004033d8
cmp byte [0x41aba8], 0
je 0x41026e
lea eax, [ebp - 4]
mov edx, 0x411714
call fcn.004032a0
jmp 0x41027b
lea eax, [ebp - 4]
mov edx, 0x411724
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411734
call fcn.0040325c
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b8]
call fcn.00404900
push dword [ebp - 0x5b8]
push 0x4117c4
mov eax, dword [ebp - 0xd4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5bc]
call fcn.00404900
push dword [ebp - 0x5bc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0xc]
Function at 0x4102d4
Capabilities:
Get common file path
Get disk information
Get disk size
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcc
push 0
push 0
dec ecx
jne 0x4101c4
push ebx
push esi
push edi
mov edi, 0x41ab78
mov ebx, dword [0x4192d4]
xor eax, eax
push ebp
push 0x4116bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4116d4
call fcn.0040325c
mov dword [ebp - 0xdc], 0x94
mov eax, 0x41ab68
mov edx, 0x4116e0
call fcn.0040325c
lea eax, [ebp - 0xdc]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xcc]
cmp esi, 2
jne 0x410232
lea eax, [ebp - 8]
mov edx, 0x4116f8
call fcn.004032a0
jmp 0x410256
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b4]
call fcn.00404900
mov ecx, dword [ebp - 0x5b4]
lea eax, [ebp - 8]
mov edx, 0x411704
call fcn.004033d8
cmp byte [0x41aba8], 0
je 0x41026e
lea eax, [ebp - 4]
mov edx, 0x411714
call fcn.004032a0
jmp 0x41027b
lea eax, [ebp - 4]
mov edx, 0x411724
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411734
call fcn.0040325c
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b8]
call fcn.00404900
push dword [ebp - 0x5b8]
push 0x4117c4
mov eax, dword [ebp - 0xd4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5bc]
call fcn.00404900
push dword [ebp - 0x5bc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0xc]
Function at 0x414750
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x414a93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab68
mov edx, 0x414aac
call fcn.0040325c
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040338c
test eax, eax
je 0x414a5a
mov eax, dword [ebp - 8]
call fcn.0040338c
test eax, eax
je 0x414a5a
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
cmp esi, 0xffffffff
jne 0x414831
push 0x414ac8
push dword [ebp - 4]
push 0x414ad8
lea edx, [ebp - 0xa4]
xor eax, eax
call fcn.004057d8
push dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 4
call fcn.0040344c
mov eax, dword [ebp - 0xa0]
call fcn.0040fd78
jmp 0x414a5a
push 0
push esi
call sub.kernel32.dll_GetFileSize
add eax, 5
add eax, 5
mov dword [ebp - 0xc], eax
mov eax, 0x41ab68
mov edx, 0x414ae4
call fcn.0040325c
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x414730]
call fcn.00403cc8
add esp, 4
mov edx, 0x41927c
mov eax, dword [ebp - 0x14]
mov ecx, 5
call fcn.004043ec
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx - 5]
mov edx, 0x419284
mov ecx, 5
call fcn.004043ec
push 0
lea eax, [ebp - 0x10]
push eax
Function at 0x41489c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [ebp - 0xc]
sub eax, 5
push eax
mov eax, dword [ebp - 0x14]
add eax, 5
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4148f4
push 0x414b60
push dword [ebp - 4]
push 0x414ad8
lea edx, [ebp - 0xac]
xor eax, eax
call fcn.004057d8
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov edx, 4
call fcn.0040344c
mov eax, dword [ebp - 0xa8]
call fcn.0040fd78
jmp 0x414a5a
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0xc], 0xa
jbe 0x414989
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 5]
cmp al, byte [0x41927c]
jne 0x414989
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 6]
cmp al, byte [0x41927d]
jne 0x414989
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 7]
cmp al, byte [0x41927e]
jne 0x414989
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 8]
cmp al, byte [0x41927f]
jne 0x414989
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 9]
cmp al, byte [0x419280]
jne 0x414989
push 0x414b74
push dword [ebp - 4]
push 0x414b84
push dword [ebp - 8]
lea eax, [ebp - 0xb0]
mov edx, 4
call fcn.0040344c
mov eax, dword [ebp - 0xb0]
call fcn.0040fd78
mov eax, 0x41ab68
mov edx, 0x414b9c
call fcn.0040325c
jmp 0x414a5a
mov edx, dword [ebp - 0xc]
dec edx
sub edx, 5
jb 0x4149cf
inc edx
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
xor byte [eax + ecx], 0xc2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
movzx eax, byte [eax + ecx]
add ax, 0x79
cmp ax, 0xff
jle 0x4149bd
sub ax, 0xff
dec eax
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
add ecx, esi
push ecx
pop ecx
mov byte [ecx], al
inc dword [ebp - 0x10]
dec edx
jne 0x41499a
mov eax, dword [ebp - 8]
call fcn.0040338c
test eax, eax
jne 0x4149e6
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x414c58
call fcn.0040325c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x414a5a
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x414a36
mov bl, 1
mov eax, 0x41ab68
mov edx, 0x414c78
call fcn.0040325c
push esi
call sub.kernel32.dll_CloseHandle
mov eax, 0x41ab68
mov edx, 0x414cb8
call fcn.0040325c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414a9a
lea eax, [ebp - 0xb0]
mov edx, 5
call fcn.0040322c
lea eax, [ebp - 0x14]
mov edx, dword [0x414730]
call fcn.00403cd4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret
Function at 0x41304a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x414c30
push 1
xor ebx, ebx
push ebx
push 0x414ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41311b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x414cd0
push eax
call dword [ecx]
test eax, eax
jl 0x413112
cmp byte [ebp + 8], bl
je 0x41309d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4130ba
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x4130cc
push 0x41437c
jmp 0x4130cf
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4130e4
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4130f5
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x413109
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x413135
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f76e6b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section._RDATA
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xf96267e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402e3b
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4151c4], 0
jne 0x402e49
call fcn.00402e11
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402e76
test cl, 7
je 0x402e76
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402e57
cmp esi, 8
jb 0x402efa
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4151c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec edi
jne 0x402e80
xor edx, edx
test esi, esi
jbe 0x402f1a
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4151c0]
inc edx
cmp edx, esi
jb 0x402f01
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x405935
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x40595b
cmp dword [ebp + 0xc], esi
jbe 0x405950
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4059ab
mov ecx, edi
call fcn.00405697
test al, al
je 0x405991
cmp dword [ebp + 0xc], esi
jbe 0x405991
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405935
jmp 0x4059ae
cmp dword [edi + 0xc], 1
jne 0x4059a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x4059a6
xor eax, eax
jmp 0x4059ae
or eax, 0xffffffff
jmp 0x4059ae
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8