joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ce4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404b37
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ce4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404b37
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404d00
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404bc0
xor eax, eax
push ebp
push 0x404bb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004048fc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b9e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404d20
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b9e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404bc0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404cda
cmp byte [ebp - 0xd], 0
jne 0x404c07
cmp byte [ebp - 0x12], 0
je 0x404cda
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404c20
dec ebx
cmp byte [ebx], 0x2e
je 0x404c2f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404c1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404cda
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404c6c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404cda
cmp byte [ebp - 0xd], 0
je 0x404cda
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404cda
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4071d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407211
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b00
jmp 0x40721a
mov eax, ebx
mov edx, esi
call fcn.00403a64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407224
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407245
mov al, byte [esp]
jmp 0x407247
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4078cc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407744
mov eax, dword [0x41f554]
cmp byte [eax], 0
je 0x407934
mov eax, dword [0x41f490]
call fcn.004027fc
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406630
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40797c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40796a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41f470]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x420710]
call fcn.004048c0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x4082fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x408360
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403c54
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004064d0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408367
lea eax, [ebp - 0xc]
call fcn.00403a10
ret
Function at 0x4097bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x40985a
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00403f60
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00403ed0
mov edx, ebp
add dl, 0x30
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x4097e4
cmp byte [esp], 0
je 0x40982b
mov eax, edi
call fcn.00403ed0
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x409866
mov eax, edi
call fcn.00403ed0
push eax
mov eax, edi
call fcn.00403ed0
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00402628
mov edx, ebx
mov eax, edi
call fcn.00403f60
jmp 0x409866
mov eax, edi
mov edx, 0x409874
call fcn.00403a64
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409eac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00403a64
mov eax, ebx
call fcn.00403ec8
mov eax, dword [ebx]
call fcn.00403c80
test eax, eax
jle 0x409edd
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x409ed2
pop esi
pop ebx
ret

Function at 0x40a658
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x40a6a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x40a696
cmp word [edi], 0x5a4d
jne 0x40a696
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x40a696
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a6ac
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a83c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x40a882
push 0x20a
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x40a8b3
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x40a910
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x40a8de
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x40a8f0
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x40a90a
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x40db18
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
jne 0x40db94
cmp dword [esp + 0x10], 0x1000
jne 0x40db94
cmp dword [esp + 4], 0
je 0x40db94
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
je 0x40db94
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x40db94
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x40db94
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4116e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x411797
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x41ef28]
call fcn.00409eac
push dword [ebp - 0xc]
push 0x4117b0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, dword [0x41ef2c]
call fcn.004115d0
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403d40
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00403e78
push eax
call fcn.004114f0
mov esi, eax
test esi, esi
je 0x41177c
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x411776
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41179e
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403a34
ret

Function at 0x4119e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x411a59
mov ebx, 0x5f040000
jmp 0x411a47
cmp dword [esp + 0x10], 0x10000
jne 0x411a25
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
jmp 0x411a59
cmp dword [esp + 0xc], 0x10000
jae 0x411a39
mov dword [esp + 0xc], 0x10000
jmp 0x411a41
and dword [esp + 0xc], 0xffff0000
mov eax, dword [esp + 0xc]
add ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x411a05
push 0x40
push 0x1000
push edi
push esi
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x411d24
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x41f018]
cmp eax, 0x1c
jne 0x411d9f
cmp dword [ebp - 0xc], 0x1000
jne 0x411d9a
cmp dword [ebp - 0x18], 0
je 0x411d9a
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x411d9a
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x411d79
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x411d9f
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x41efe8]
cmp eax, 0
je 0x411d9a
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x41f040]
add ebx, dword [ebp - 0x10]
jmp 0x411d3b
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x415744
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41592b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, dword [0x41ee98]
call fcn.0040d994
mov dword [0x420b08], eax
xor edx, edx
mov eax, dword [0x41ee9c]
call fcn.0040d994
mov dword [0x420b0c], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.00403f60
lea eax, [ebp - 8]
call fcn.00403ed0
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.00403ed0
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.00403ed0
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.00403ed0
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.00403ed0
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, dword [0x41ef10]
call fcn.00409eac
push dword [ebp - 0xc]
push 0x415944
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00409b54
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403d40
mov eax, dword [ebp - 8]
call fcn.00403e78
push eax
push 0
push 0
call fcn.004051ac
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x415910
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x420afc], esi
mov dword [0x420b00], edi
cmp dword [0x420b08], 0
je 0x415860
cmp dword [0x420b0c], 0
jne 0x4158e2
mov dl, 1
mov eax, dword [0x41ee14]
call fcn.0040da7c
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x4158f4
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x4158f4
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x4158f4
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x4158f4
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x4158f4
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4158f4
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x420b04], edx
mov edx, 0x4156f4
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 4]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x4158f4
push 0x4156a0
push 1
call dword [0x420b08]
test eax, eax
setne bl
test bl, bl
jne 0x415910
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415932
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403a34
ret
Function at 0x415948
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x420b08], 0
je 0x415960
cmp dword [0x420b0c], 0
jne 0x4159b9
mov dl, 1
mov eax, dword [0x41ee14]
call fcn.0040da7c
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41599f
mov eax, dword [0x420b04]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x4159c4
push 0x4156a0
call dword [0x420b0c]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4179ec
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403e68
xor eax, eax
push ebp
push 0x417aac
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
setne bl
xor eax, eax
mov dword [ebp - 8], eax
test bl, bl
jne 0x417a96
cmp dword [ebp - 4], 0
jne 0x417a39
lea edx, [ebp - 8]
mov eax, esi
call fcn.00410f9c
test al, al
je 0x417a96
call sub.kernel32.dll_GetCurrentProcess
lea edx, [ebp - 0xc]
call fcn.00410f9c
test al, al
je 0x417a87
cmp dword [ebp - 4], 0
je 0x417a67
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x417a7e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree_1
cmp dword [ebp - 8], 0
je 0x417a96
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417ab3
lea eax, [ebp - 4]
call fcn.00403a10
ret

Function at 0x418224
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x4182cd
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov ebx, eax
push ebx
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov edi, eax
test edi, edi
je 0x4182c7
push 0
lea eax, [esp + 4]
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4182c1
cmp ebx, dword [esp]
jne 0x4182c1
xor ebx, ebx
mov eax, dword [esp]
dec eax
shr eax, 1
test eax, eax
jl 0x4182ab
inc eax
xor edx, edx
movzx ecx, word [edi + edx*2]
add ebx, ecx
test ebx, 0xffff0000
je 0x4182a7
mov ecx, ebx
and ecx, 0xffff
shr ebx, 0x10
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x41828a
mov eax, ebx
and ax, 0xffff
shr ebx, 0x10
add ax, bx
movzx eax, ax
mov ebx, eax
mov ebp, dword [esp]
add ebp, ebx
push edi
call sub.kernel32.dll_LocalFree_1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4182d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4183e7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x4208d8], 0
jne 0x4183b9
cmp byte [0x41f13c], 0
je 0x418321
push ebx
push 0x104
call sub.kernel32.dll_GetTempPathW
jmp 0x41832c
push 0x104
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jne 0x41833b
mov word [ebx], 0x2e
mov word [ebx + 2], 0
push ebx
call sub.kernel32.dll_lstrlenW
cmp word [ebx + eax*2 - 2], 0x5c
je 0x418354
push 0x4183f4
push ebx
call sub.kernel32.dll_lstrcatW
lea edx, [ebp - 0x44]
mov eax, dword [0x41ef68]
call fcn.00409eac
push dword [ebp - 0x44]
push 0x418400
lea edx, [ebp - 0x48]
mov eax, dword [0x41ef60]
call fcn.00409eac
push dword [ebp - 0x48]
push 0x41840c
lea edx, [ebp - 0x4c]
mov eax, dword [0x41ef6c]
call fcn.00409eac
push dword [ebp - 0x4c]
lea eax, [ebp - 4]
mov edx, 5
call fcn.00403d40
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e78
push eax
call fcn.00410c34
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_lstrcatW
jmp 0x4183c4
push 0x4208d8
push ebx
call sub.kernel32.dll_lstrcpyW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4183ee
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00403a34
lea eax, [ebp - 4]
call fcn.00403a10
ret

Function at 0x418410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e68
xor eax, eax
push ebp
push 0x418496
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
mov al, byte [ebx]
mov byte [ebp - 5], al
inc ebx
mov edx, dword [ebx]
mov eax, edi
call fcn.00403f60
add ebx, 4
mov esi, dword [edi]
mov al, byte [ebx]
cmp al, byte [ebp - 5]
jne 0x41846d
inc ebx
mov eax, ebx
inc eax
movzx eax, byte [eax]
test eax, eax
jle 0x418468
mov dl, byte [ebx]
xor dl, 0x55
mov byte [esi], dl
inc esi
dec eax
jne 0x41845d
add ebx, 2
jmp 0x418473
xor al, 0x55
mov byte [esi], al
inc esi
inc ebx
mov eax, dword [edi]
call fcn.00403c80
add eax, dword [edi]
cmp eax, esi
ja 0x41844b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41849d
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x418ad4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403e68
xor eax, eax
push ebp
push 0x418ba1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403e78
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x418b71
xor ebx, ebx
jmp 0x418b4e
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00403c54
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.00418ad4
pop ecx
inc ebx
push 0x104
lea eax, [ebp - 0x10d]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x418b24
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
call fcn.00403e78
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418ba8
lea eax, [ebp - 0x114]
call fcn.00403a10
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x419d94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00419ad8
pop ecx
test al, al
jne 0x419ebc
push 0x104
lea eax, [ebp - 0x111]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.00419ad8
pop ecx
test al, al
jne 0x419ebc
push 0x104
lea eax, [ebp - 0x111]
push eax
mov eax, dword [0x420710]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [0x420710]
push eax
call sub.kernel32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.00419ad8
pop ecx
test al, al
jne 0x419ebc
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x31c]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.00419ad8
pop ecx
test al, al
jne 0x419ebc
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 0x104
lea eax, [ebp - 0x31c]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.00419ad8
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41a550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
je 0x41a57b
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
push ebx
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x41a58f
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x41a593
xor eax, eax
jmp 0x41a595
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8