joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463f80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x463fea
mov eax, ebx
call fcn.00466344
test al, al
jne 0x463fea
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ca4
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x463fd7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463ff7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c08
jmp 0x463ff7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c08
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x465468
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4654d6
mov eax, esi
call fcn.0044e0b8
test al, al
je 0x4654d6
mov eax, dword [ebx + 0x84]
call fcn.0044dd18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4654d6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4654ca
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044dd18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00445b94
jmp 0x4654d6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004652a4
pop esi
pop ebx
ret

Function at 0x474b74
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405034
xor eax, eax
push ebp
push 0x474bf2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405044
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x474bbd
mov eax, dword [ebx + 4]
call fcn.00405044
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474bf9
lea eax, [ebp - 4]
call fcn.00404bb4
ret
Function at 0x475c64
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475e09
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.0040332c
cmp word [ebx + 0xa2], 0
je 0x475cad
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x475cc1
lea esi, [ebp - 0xc]
jmp 0x475cc3
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x475cd0
xor edi, edi
jmp 0x475cdd
mov eax, dword [ebx + 0x80]
call fcn.00405044
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00405044
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00475344
mov eax, dword [ebp - 0x14]
call fcn.00405044
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00405044
push eax
mov eax, dword [ebp - 4]
call fcn.00405044
push eax
mov eax, ebx
call fcn.00475484
push eax
mov eax, ebx
call fcn.00475458
push eax
mov eax, ebx
call fcn.00475410
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00475210
mov eax, dword [ebp - 0x18]
call fcn.00405044
push eax
mov eax, dword [ebx + 8]
call fcn.00405044
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x475d66
call fcn.0040e608
xor edx, edx
push ebp
push 0x475ddf
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x475da4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x475d9a
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475de6
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x475e18
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x475e44
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405044
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x475e69
call fcn.0040e608
xor eax, eax
push ebp
push 0x475ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x475e89
call fcn.0040e608
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475ea7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x476ab0
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov byte [ebx + 0x14], 1
push esp
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476ad2
movzx eax, byte [esp + 4]
mov byte [ebx + 0x14], al
jmp 0x476af8
call sub.kernel32.dll_GetLastError
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
lea eax, [esp + 0x1c]
push eax
push 0
mov ecx, 0x476b08
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdfc
add esp, 0x24
pop ebx
ret

Function at 0x476b80
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x476cd6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.004768d0
mov esi, eax
test esi, esi
jne 0x476bc6
mov ecx, 0x476cec
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdc0
call fcn.00404548
jmp 0x476cc8
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476cc8
movzx eax, byte [ebp - 0x24]
mov byte [ebx + 0x14], al
cmp al, 1
jne 0x476cc8
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
test eax, eax
je 0x476cb2
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476cc8
movzx eax, byte [ebp - 0x24]
mov byte [ebx + 0x14], al
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x476c8e
mov eax, dword [ebp - 0x10]
mov ecx, 0xa
xor edx, edx
div ecx
mov edi, eax
cmp edi, 0x3e8
jae 0x476c41
mov edi, 0x3e8
jmp 0x476c4e
cmp edi, 0x2710
jbe 0x476c4e
mov edi, 0x2710
push edi
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476c94
movzx eax, byte [ebp - 0x24]
mov byte [ebx + 0x14], al
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jbe 0x476c81
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x476c8e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
ja 0x476c94
cmp byte [ebx + 0x14], 2
je 0x476c24
cmp byte [ebx + 0x14], 4
je 0x476cc8
mov ecx, 0x476d08
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdc0
call fcn.00404548
jmp 0x476cc8
mov ecx, 0x476d24
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdc0
call fcn.00404548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476cdd
ret
Function at 0x476d3c
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebx, eax
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov dword [esp + 4], 0x7530
mov eax, ebx
call fcn.004768d0
mov esi, eax
test esi, esi
jne 0x476d7c
mov ecx, 0x476e90
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdc0
call fcn.00404548
jmp 0x476e7f
lea eax, [esp + 8]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476e7f
movzx eax, byte [esp + 0xc]
mov byte [ebx + 0x14], al
cmp al, 1
je 0x476e7f
lea eax, [esp + 8]
push eax
push 1
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x476e54
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
jmp 0x476e48
mov eax, dword [esp + 0x20]
mov ecx, 0xa
xor edx, edx
div ecx
mov ebp, eax
cmp ebp, 0x3e8
jae 0x476de1
mov ebp, 0x3e8
jmp 0x476dee
cmp ebp, 0x2710
jbe 0x476dee
mov ebp, 0x2710
push ebp
call sub.kernel32.dll_Sleep_1
lea eax, [esp + 8]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x476e7f
movzx eax, byte [esp + 0xc]
mov byte [ebx + 0x14], al
cmp byte [ebx + 0x14], 1
je 0x476e48
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp]
jbe 0x476e2a
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
jmp 0x476e48
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, dword [esp + 4]
jbe 0x476e48
mov ecx, 0x476eac
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdc0
cmp byte [ebx + 0x14], 1
jne 0x476dc3
jmp 0x476e7f
call sub.kernel32.dll_GetLastError
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0
lea eax, [esp + 0x24]
push eax
push 0
mov ecx, 0x476ec4
mov dl, 1
mov eax, dword [0x476694]
call fcn.0040cdfc
call fcn.00404548
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5f9456b7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x41246140
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x6df3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.06df378f
jae 0x6df370e
xor ecx, ecx
call fcn.06df378f
jae 0x6df373d
xor eax, eax
call fcn.06df378f
jae 0x6df374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.06df378f
adc al, al
jae 0x6df372f
jne 0x6df3779
stosb byte es:[edi], al
jmp 0x6df3711
call fcn.06df379b
sub ecx, ebx
jne 0x6df3756
call fcn.06df3799
jmp 0x6df3775
lodsb al, byte [esi]
shr eax, 1
je 0x6df3783
adc ecx, ecx
jmp 0x6df3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.06df3799
cmp eax, 0x7d00
jae 0x6df3772
cmp ah, 5
jae 0x6df3773
cmp eax, 0x7f
ja 0x6df3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6df3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str.db_nljhvtrpzxFDB_NLJHVTR___.__6420__:8]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str.db_nljhvtrpzxFDB_NLJHVTR___.__6420__:8]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str.db_nljhvtrpzxFDB_NLJHVTR___.__6420__:8]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str.db_nljhvtrpzxFDB_NLJHVTR___.__6420__:8]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x410252
call fcn.0040347e
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, 0x41098b
push eax
push ebx
call fcn.004034ae
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c7c8
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.0040347e
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
je 0x401268
push str._6__b_
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push str.B__4
call fcn.0040347e
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, 0x41098b
push 0
push edi
call fcn.004034ae
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c7c8
lea eax, [ebp - 0x814]
push eax
call fcn.0040c7c8
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.0040347e
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403c88
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push 0x40f034
push eax
call fcn.00407660
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40f0c0
call fcn.00407840
xor ebx, ebx
mov dword [esp], str.__n___f_F
push ebx
mov dword [ebp - 0x14], eax
call fcn.00405449
push ebx
push 0x410bc5
call fcn.004034ae
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00407750
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c920
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4131d0
push ebx
push edi
call fcn.004076f0
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x410bc5
call fcn.0040347e
push eax
mov dword [ebp - 0x10], eax
call fcn.00407840
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4131d0]
push edi
push 0x40f0c0
call fcn.0040c870
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c870
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x410df0
call fcn.0040347e
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403f05
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x404a18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
and dword [ebp - 4], 0
cmp dword [0x4938f0], 0
jne 0x404a53
push 4
push 0x410252
call fcn.0040347e
lea ecx, [ebp - 4]
push ecx
push 0x40494a
push eax
push closesocket
call fcn.00404691
add esp, 0x18
jmp 0x404a8f
lea eax, [ebp - 0x418]
push 2
push eax
call fcn.00403ce3
lea eax, [ebp - 0x418]
push eax
push 0x4934e0
call fcn.00407750
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push 0x4048b6
push eax
push closesocket
call fcn.0040470f
add esp, 0x20
mov eax, dword [ebp - 4]
test eax, eax
mov dword [0x4938f4], eax
jne 0x404b70
push esi
lea eax, [ebp - 0x51c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor esi, esi
and byte [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push str.H4:0
push eax
call fcn.00407750
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push 4
push 4
push 2
push eax
call fcn.00407840
pop ecx
lea eax, [ebp + eax - 0x18]
push eax
call fcn.0040372f
lea eax, [ebp - 0x17]
push eax
call fcn.0040c9ac
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00407750
lea eax, [ebp - 0x418]
push 0x40f044
push eax
call fcn.00407760
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00407760
lea eax, [ebp - 0x418]
push 0x4101dc
push eax
call fcn.00407760
lea eax, [ebp - 0x418]
push eax
call fcn.00403e63
add esp, 0x38
test eax, eax
je 0x404b4d
inc esi
cmp esi, 0xa
jl 0x404ab4
lea eax, [ebp - 0x18]
push eax
push 0x4933dc
call fcn.00407760
lea eax, [ebp - 0x418]
push eax
push 0x4935e4
call fcn.00407750
add esp, 0x10
pop esi
push 1
pop eax
leave
ret

Function at 0x404cc5
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x44
jb 0x404d00
mov ecx, dword [esp + 8]
cmp byte [ecx], 0x4d
jne 0x404d00
cmp byte [ecx + 1], 0x5a
jne 0x404d00
movzx eax, word [ecx + 0x3c]
add eax, ecx
add esi, 0xfffffffc
mov edx, eax
sub edx, ecx
cmp edx, esi
ja 0x404d00
mov eax, dword [eax]
pop esi
sub eax, 0x4550
neg eax
sbb eax, eax
not eax
and eax, edx
ret
xor eax, eax
pop esi
ret