joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x431dc8]
sub esi, dword [0x431dc4]
add esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
mov dword [0x431dc0], eax
test esi, esi
jle 0x404ec4
push dword [0x431dcc]
call fcn.00404d15
push 0
push 0
push dword [0x431dc4]
push dword [0x41d014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [0x431dd8], 0
mov edi, 0x4000
mov dword [0x431dd4], esi
mov esi, dword [0x431dd0]
sub esi, dword [0x431dcc]
cmp esi, edi
cmovg esi, edi
jmp 0x404e95
add dword [0x431dcc], esi
mov ecx, dword [0x431dc4]
mov dword [0x431df8], edi
mov dword [0x431dfc], esi
cmp dword [0x431db0], 0
je 0x404dec
cmp dword [0x41dc88], 0
jne 0x404dec
mov eax, dword [0x431dd4]
sub eax, dword [0x431dc8]
sub eax, dword [ebp + 8]
add eax, ecx
push 0
mov dword [0x431dd8], eax
call fcn.00405191
pop ecx
mov ecx, 0x431de0
mov dword [0x431e00], 0x435e68
mov dword [0x431e04], 0x8000
call fcn.0040107e
test eax, eax
js 0x404ed4
mov edi, dword [0x431e00]
mov ecx, 0x435e68
sub edi, ecx
je 0x404e5b
push 0
lea eax, [ebp - 4]
push eax
push edi
push ecx
push dword [0x41d014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404eae
cmp edi, dword [ebp - 4]
jne 0x404eae
mov ecx, dword [0x431dc4]
add ecx, edi
cmp dword [0x431dfc], 0
mov dword [0x431dc4], ecx
jne 0x404dbd
jmp 0x404e6e
cmp dword [0x431dfc], 0
jne 0x404ed4
test esi, esi
je 0x404ed4
mov ecx, dword [0x431dc4]
mov edx, dword [0x431dc8]
mov eax, edx
sub eax, ecx
add eax, dword [ebp + 8]
test eax, eax
jle 0x404eb3
mov esi, dword [0x431dd0]
mov eax, 0x4000
sub esi, dword [0x431dcc]
cmp esi, eax
cmovg esi, eax
push esi
mov edi, 0x431e68
push edi
call fcn.00404ce3
test eax, eax
jne 0x404da5
or eax, 0xffffffff
jmp 0x404ece
push 0xfffffffffffffffe
pop eax
jmp 0x404ece
push 0
push 0
push edx
push dword [0x41d014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00405191
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4
push 0xfffffffffffffffd
jmp 0x404eb0
Function at 0x404ed8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
push edi
xor edi, edi
test ecx, ecx
js 0x404f02
mov eax, dword [0x431da8]
push edi
add eax, ecx
push edi
push eax
push dword [0x41d014]
mov dword [0x431dc8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00404d2f
test eax, eax
js 0x404ff3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push edi
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [0x41d014]
call ebx
test eax, eax
je 0x404fef
cmp dword [ebp + 8], esi
jne 0x404fef
push dword [ebp - 4]
add dword [0x431dc8], esi
call fcn.00404d2f
mov esi, eax
test esi, esi
js 0x404feb
cmp dword [ebp + 0x10], edi
jne 0x404fc3
mov ecx, dword [ebp - 4]
jmp 0x404fb9
mov edi, 0x4000
lea eax, [ebp + 8]
push 0
cmp ecx, edi
push eax
cmovl edi, ecx
push edi
push 0x431e68
push dword [0x41d014]
call ebx
test eax, eax
je 0x404fef
cmp edi, dword [ebp + 8]
jne 0x404fef
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
push 0x431e68
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404fbf
cmp dword [ebp + 0x10], edi
jne 0x404fbf
mov eax, dword [ebp + 8]
add esi, eax
mov ecx, dword [ebp - 4]
sub ecx, eax
add dword [0x431dc8], eax
mov dword [ebp - 4], ecx
test ecx, ecx
jg 0x404f5f
jmp 0x404feb
push 0xfffffffffffffffe
jmp 0x404ff1
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 4], eax
cmovl eax, dword [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x41d014]
call ebx
test eax, eax
je 0x404fef
mov esi, dword [ebp + 8]
add dword [0x431dc8], esi
mov eax, esi
jmp 0x404ff2
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x405191
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x4051b9
mov eax, dword [0x43ded4]
test eax, eax
je 0x4051b0
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x43ded4], 0
leave
ret
cmp dword [0x43ded4], 0
je 0x4051cb
push 0
call fcn.00409172
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x431dc0]
jbe 0x405235
cmp dword [0x44e3c8], 0
je 0x405210
test byte [0x41dc9c], 1
je 0x405235
call fcn.00404ff9
push eax
lea eax, [ebp - 0x80]
push 0x4163fc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.004086e6
leave
ret
push 0
push 0x405559
push 0
push 0x6f
push dword [0x44e3cc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x43ded4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x4057e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [0x48469c]
mov edx, 0x19f
push 0x60
pop eax
mov word [ebp - 0x2e], ax
lea eax, [edx - 0xb]
mov dword [ebp - 0x3c], 0x3d413378
mov word [ebp - 0x20], ax
push 0x21
pop eax
mov word [ebp - 0x1e], ax
push 0x64
pop eax
mov word [ebp - 0xe], ax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x38], 0x6f620d4f
mov dword [ebp - 0x34], 0xf391b11d
mov word [ebp - 0x30], dx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x44e4fc]
mov dword [ebp - 0x2c], 0x3d5d3348
mov dword [ebp - 0x28], 0x6f650d5e
mov dword [ebp - 0x24], 0xf3dfb106
mov dword [ebp - 0x1c], 0x3d5d3354
mov dword [ebp - 0x18], 0x6f790d4e
mov dword [ebp - 0x14], 0xf3ddb10e
mov word [ebp - 0x10], dx
mov dword [ebp - 0xc], 0x3d33334f
cmp eax, dword [ecx + 4]
jg 0x405883
jmp 0x40587c
pop esi
mov eax, 0x44e4c4
leave
ret
push esi
mov esi, 0x44e4fc
push esi
call fcn.0040a154
cmp dword [0x44e4fc], 0xffffffff
pop ecx
jne 0x40587b
xorps xmm0, xmm0
mov byte [0x44e4f8], 1
movlpd qword [ebp - 8], xmm0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
jmp 0x4058b0
mov ax, word [ebp + ecx*2 - 0x3c]
mov word [ecx*2 + 0x44e4c4], ax
add ecx, 1
adc edx, 0
jne 0x4058cc
cmp ecx, 0x1a
jb 0x4058b0
jmp 0x4058cc
push 0x415959
call fcn.00409fc3
push esi
call fcn.0040a10a
pop ecx
pop ecx
jmp 0x40587b
Function at 0x4064a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ecx, dword [0x48469c]
mov eax, 0x19f
push esi
push edi
mov word [ebp - 0x48], ax
push 0x21
pop eax
mov word [ebp - 0x46], ax
mov eax, 0x1b7
mov word [ebp - 0x38], ax
add eax, 0xffffffea
push 0x64
mov word [ebp - 0x28], ax
mov eax, 0x1bf
pop edx
mov word [ebp - 0x18], ax
push 0x6e
pop eax
mov word [ebp - 0x16], ax
mov eax, 0xb16f
mov word [ebp - 0xc], ax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x54], 0x3d5c337e
mov dword [ebp - 0x50], 0x6f790d53
mov dword [ebp - 0x4c], 0xf3deb11d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x462624]
mov dword [ebp - 0x44], 0x3d52336d
mov dword [ebp - 0x40], 0x6f680d53
mov dword [ebp - 0x3c], 0xf3edb103
mov word [ebp - 0x36], dx
mov dword [ebp - 0x34], 0x3d58334e
mov dword [ebp - 0x30], 0x6f620d49
mov dword [ebp - 0x2c], 0xf3edb11f
mov word [ebp - 0x26], dx
mov dword [ebp - 0x24], 0x3d5c334e
mov dword [ebp - 0x20], 0x6f7f0d48
mov dword [ebp - 0x1c], 0xf3d4b10c
mov dword [ebp - 0x14], 0x3d52335e
mov dword [ebp - 0x10], 0x6f680d51
cmp eax, dword [ecx + 4]
jg 0x406575
pop edi
pop esi
mov eax, 0x4625d8
pop ebx
leave
ret
mov esi, 0x462624
push esi
call fcn.0040a154
cmp dword [0x462624], 0xffffffff
pop ecx
jne 0x40656b
xorps xmm0, xmm0
mov byte [0x462622], 1
movlpd qword [ebp - 8], xmm0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
jmp 0x4065a1
mov ax, word [ebp + ecx*2 - 0x54]
mov word [ecx*2 + 0x4625d8], ax
add ecx, 1
adc edx, 0
jne 0x4065bd
cmp ecx, 0x25
jb 0x4065a1
jmp 0x4065bd
push 0x415995
call fcn.00409fc3
push esi
call fcn.0040a10a
pop ecx
pop ecx
jmp 0x40656b
Function at 0x4087cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x40881d
ja 0x4087e6
cmp dword [ebp + 0xc], 0
jbe 0x40881d
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov edx, dword [ebp + 0x18]
and ecx, 7
shl ecx, 3
call fcn.0040a250
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x4087f2
ja 0x40881a
cmp esi, dword [ebp + 0xc]
jb 0x4087f2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40921c
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0xc
mov ecx, dword [0x48469c]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4843fc]
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x409419
push 0x4165d4
push 0x4833e8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x409298
push 1
push ebx
push esi
call fcn.00409826
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x4833e8
push esi
call edi
test eax, eax
je 0x4093e4
mov esi, 0x400
cmp eax, esi
jg 0x4093e4
jmp 0x40929d
mov esi, 0x400
push esi
push 0x482be8
push dword [ebp + 8]
call edi
test eax, eax
je 0x4093e4
cmp eax, esi
jg 0x4093e4
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x483fe8
push 0xffffffffffffffff
push 0x4833e8
push ebx
push ebx
call esi
test eax, eax
je 0x4093e4
push ebx
push ebx
push 0x400
mov edi, 0x483be8
push edi
push 0xffffffffffffffff
push 0x482be8
push ebx
push ebx
call esi
test eax, eax
je 0x4093e4
push edi
push 0x483fe8
push str._s_s_r_n
push 0x4827e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x431db0]
add esp, 0x10
mov edi, eax
mov ebx, 0x482be8
mov dword [ebp + 0xc], edi
push dword [ecx + 0x128]
push ebx
call fcn.00408ecc
push 4
push 0xc0000000
push ebx
call fcn.00409826
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
je 0x4093e4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [edi + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4093dd
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4093dd
cmp esi, dword [ebp - 8]
jne 0x4093dd
push dword [0x4843e8]
push edi
call fcn.00409af3
test eax, eax
jne 0x4093e9
push dword [0x4843e8]
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push dword [ebp + 0xc]
lea eax, [ecx + edi]
push 0x4827e8
push eax
call fcn.00409d1b
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
push 0x4165e4
add eax, 0xa
push eax
call fcn.00409af3
mov ecx, eax
test ecx, ecx
je 0x4093a3
lea edx, [edi + esi]
cmp edx, ecx
jbe 0x409414
mov ebx, dword [ebp + 0xc]
mov al, byte [edx]
mov byte [ebx + edx], al
dec edx
cmp edx, ecx
ja 0x409407
mov ebx, dword [ebp - 0xc]
sub ecx, edi
inc ecx
jmp 0x4093a5
mov edi, 0x4843fc
push edi
call fcn.0040a154
cmp dword [0x4843fc], 0xffffffff
pop ecx
jne 0x409245
lea ecx, [ebp - 1]
call fcn.0040898a
mov esi, eax
mov ecx, esi
call fcn.00409487
push edi
mov dword [0x4843e8], esi
call fcn.0040a10a
pop ecx
jmp 0x409245
Function at 0x40954e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
mov ebx, 0x47e7e0
push ebx
call fcn.00409ad1
push ebx
call fcn.00409b7b
mov esi, eax
test esi, esi
je 0x4095c5
push esi
call fcn.00409c0f
test byte [0x431db4], 0x80
je 0x409589
movzx eax, word [esi]
test ax, ax
je 0x4095c5
cmp eax, 0x5c
je 0x4095c5
sub esi, ebx
sar esi, 1
jmp 0x4095a3
call fcn.004094f9
test eax, eax
je 0x40959d
test byte [eax], 0x10
je 0x4095c5
push ebx
call fcn.00409bdf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x40958f
call fcn.00409455
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4095c5
xor eax, eax
inc eax
jmp 0x4095c7
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4095cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x47a790], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x47a790
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409608
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x40960c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040954e
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test bl, 8
je 0x409642
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x41dc70], eax
jmp 0x4097e7
push edi
mov edi, ebx
and edi, 1
mov dword [ebp - 4], edi
je 0x40965e
test eax, eax
je 0x4097d6
test bl, 2
je 0x409799
push esi
push 0x47a7d8
call fcn.00409ad1
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x409681
push str..
push 0x47a7d8
call edi
jmp 0x409687
push esi
call fcn.00409bdf
xor eax, eax
cmp word [esi], ax
jne 0x409698
cmp word [0x47a7d8], 0x5c
jne 0x4096a0
push 0x4163f0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [esi + eax*2]
lea eax, [ebp - 0x258]
mov dword [ebp + 8], edi
push eax
push 0x47a7d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x40978a
lea edi, [ebp - 0x22c]
push 0x3f
mov eax, edi
push eax
call fcn.00409523
xor ecx, ecx
cmp word [eax], cx
je 0x4096ee
cmp word [ebp - 0x24], cx
lea eax, [ebp - 0x24]
cmove eax, edi
mov edi, eax
push 0x2e
pop edx
cmp word [edi], dx
jne 0x40970a
movzx eax, word [edi + 2]
test ax, ax
je 0x409767
cmp ax, dx
jne 0x40970a
cmp word [edi + 4], cx
je 0x409767
push edi
push dword [ebp + 8]
call fcn.00409ad1
test byte [ebp - 0x258], 0x10
je 0x40972e
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x409767
push ebx
push esi
call fcn.0040960c
jmp 0x409767
push esi
call fcn.00409b59
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40975f
test bl, 4
je 0x409757
push esi
push 0xfffffffffffffff1
call fcn.004086e6
xor eax, eax
push eax
push esi
call fcn.004091a0
jmp 0x409767
inc dword [0x41dc70]
jmp 0x409767
push esi
push 0xfffffffffffffff2
call fcn.004086e6
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4096cb
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x4097e6
xor eax, eax
mov word [edi - 2], ax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4097d6
push esi
call fcn.004094f9
test eax, eax
je 0x4097e6
push esi
call fcn.00409455
push esi
call fcn.00409b59
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4097de
test bl, 4
je 0x4097d6
push esi
push 0xfffffffffffffff1
call fcn.004086e6
xor eax, eax
push eax
push esi
call fcn.004091a0
jmp 0x4097e6
inc dword [0x41dc70]
jmp 0x4097e6
push esi
push 0xffffffffffffffe5
call fcn.004086e6
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409826
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [ebp + 0x10]
push ecx
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop ebp
ret 0xc
Function at 0x409853
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4098cd
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x4008
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4098b6
cmp dword [ebp + 0x14], 1
je 0x4098bb
cmp dword [ebp + 0x14], 2
je 0x4098bb
xor eax, eax
mov word [esi], ax
push dword [ebp - 4]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0x14

Function at 0x4098f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4165cc]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x4165d0]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40993c
test edi, edi
jne 0x4098fd
mov word [esi], ax
jmp 0x40993e
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x409b59
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409b77
and eax, 0xfffffffe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4
Function at 0x4024e0
Capabilities:
Encrypt data using rc4 prga
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [ebp + 0x10]
mov byte [ebp - 1], al
mov cl, byte [ebp - 1]
mov byte [ebp - 0x10], cl
cmp byte [ebp - 0x10], 0x96
je 0x402503
cmp byte [ebp - 0x10], 0xc7
je 0x40255a
jmp 0x4025f1
mov dl, byte [ebp - 1]
mov byte [ebp - 0x14], dl
cmp byte [ebp - 0x14], 0x61
je 0x402527
cmp byte [ebp - 0x14], 0x78
je 0x402517
jmp 0x40253e
push 0xffffffffffffffcb
push 0xffffffffffffffd8
push 0x18
call fcn.00401840
add esp, 0xc
jmp 0x40253e
movzx eax, byte [ebp + 0x10]
sub eax, 0x50
mov byte [ebp - 1], al
movzx ecx, byte [ebp + 0x10]
add ecx, 0xdc
mov byte [ebp - 1], cl
mov dl, byte [ebp - 1]
mov byte [ebp + 0x10], dl
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
mov dword [ebp - 8], eax
jmp 0x4025f1
movsx edx, word [ebp + 0xc]
cmp edx, 0x1fb
jne 0x4025f1
movzx eax, word [ebp + 0x14]
push eax
mov edx, dword [ebp + 8]
mov cl, 0xe5
call fcn.004014b0
movzx ecx, byte [ebp + 0x10]
and ecx, 0x67
mov byte [ebp - 1], cl
movzx edx, byte [ebp + 0x10]
sar edx, 6
mov byte [ebp - 1], dl
movzx eax, byte [ebp + 0x10]
xor eax, 0x23
mov byte [ebp - 1], al
movsx ecx, word [ebp + 0xc]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x94
je 0x4025b2
cmp dword [ebp - 0x18], 0x22f
je 0x4025eb
jmp 0x4025f1
movzx edx, word [ebp + 0x14]
push edx
movzx eax, byte [ebp - 1]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024e0
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp + 0x10], al
movzx ecx, byte [ebp + 0x10]
or ecx, 0x98
mov byte [ebp - 1], cl
movzx edx, byte [ebp + 0x10]
shl edx, 1
mov byte [ebp - 1], dl
jmp 0x4025f1
mov al, byte [ebp - 1]
mov byte [ebp + 0x10], al
mov eax, 0x7c
mov esp, ebp
pop ebp
ret
Function at 0x406953
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040583f
and dword [ebp - 4], 0
cmp dword [0x4173a0], 0
mov ebx, eax
jne 0x406a04
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ab5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406ab5
push eax
call fcn.004057cd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4173a0], eax
call esi
push eax
call fcn.004057cd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4173a4], eax
call esi
push eax
call fcn.004057cd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4173a8], eax
call esi
push eax
call fcn.004057cd
pop ecx
mov dword [0x4173b0], eax
test eax, eax
je 0x406a04
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004057cd
pop ecx
mov dword [0x4173ac], eax
mov eax, dword [0x4173ac]
cmp eax, ebx
je 0x406a5c
cmp dword [0x4173b0], ebx
je 0x406a5c
push eax
call fcn.00405848
push dword [0x4173b0]
mov esi, eax
call fcn.00405848
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406a5c
test edi, edi
je 0x406a5c
call esi
test eax, eax
je 0x406a53
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406a53
test byte [ebp - 0xc], 1
jne 0x406a5c
or dword [ebp + 0x10], 0x200000
jmp 0x406a95
mov eax, dword [0x4173a4]
cmp eax, ebx
je 0x406a95
push eax
call fcn.00405848
pop ecx
test eax, eax
je 0x406a95
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a95
mov eax, dword [0x4173a8]
cmp eax, ebx
je 0x406a95
push eax
call fcn.00405848
pop ecx
test eax, eax
je 0x406a95
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4173a0]
call fcn.00405848
pop ecx
test eax, eax
je 0x406ab5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406ab7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4087e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411a08]
jne 0x4087f2
repz ret
jmp fcn.00409f15