joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59efd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0xe87cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0xe7c670]
mov eax, dword [esi*4 + 0xe7c6b0]
xor eax, dword [esp]
call fcn.0059ef70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.0059efac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0xe7c680]
mov eax, dword [esi*4 + 0xe7c6c0]
xor eax, dword [esp]
call fcn.0059ef70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.0059efac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0xe7c690]
mov eax, dword [esi*4 + 0xe7c6d0]
xor eax, dword [esp]
call fcn.0059ef70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.0059efac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0xe7c6a0]
mov eax, dword [esi*4 + 0xe7c6e0]
xor eax, dword [esp]
call fcn.0059ef70
mov edi, eax
mov eax, edi
call fcn.0059efac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x59efe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x59f138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x59f16d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x59f193
inc ebx
cmp ebx, 0xf
jne 0x59f17d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x59f14f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a8ee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0xe810f4
mov ebx, 0xe8bce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.005a7e30
mov dword [esp + 8], eax
mov eax, edi
call fcn.005a7e40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.005a7e30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.005a7e40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x5a8ef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x9f2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009f21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9f207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f206a
add dl, dl
jne 0x9f2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f20dc
xor eax, eax
add dl, dl
jne 0x9f2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f217d
add dl, dl
jne 0x9f20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9f20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9f2075
mov eax, 1
add dl, dl
jne 0x9f20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f20e1
sub eax, ebx
mov ebx, 1
jne 0x9f2128
mov ecx, 1
add dl, dl
jne 0x9f210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9f213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f2136
cmp eax, 0x7d00
jae 0x9f216d
cmp eax, 0x500
jb 0x9f2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
cmp eax, 0x7f
ja 0x9f2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9f219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9f2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4028ef
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40292e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40292e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40292e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40292e
cmp dword [ecx + 0x74], 0xe
jbe 0x40292e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40cff2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40cffe
mov eax, 0x4344c8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d012
test al, 0x10
jne 0x40d012
push 1
pop eax
ret
xor eax, eax
ret

Function at 0x40f944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x43b74c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f99b
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x440a1c
push 0
push 0
push 0x43b738
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f992
mov byte [0x441a1c], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40fb6c
Capabilities:
Hide graphical window

Disassembly:
push dword [0x441a2c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40fb98
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x441a2c]
call esi
push 0
push dword [0x441a20]
call esi
pop esi
ret
Function at 0x4126c8
Capabilities:
Check os version

Disassembly:
mov eax, 0x432834
call fcn.00425db8
sub esp, 0x3e8
push ebx
push esi
lea eax, [ebp - 0xe8]
push edi
mov dword [ebp - 0x10], ecx
push eax
mov dword [ebp - 0xe8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xe4], 5
jne 0x412824
cmp dword [ebp - 0xe0], 2
jne 0x412824
cmp byte [ebp - 0x4e], 1
je 0x412824
push 0x43bb40
push dword [ebp + 8]
call fcn.00426680
pop ecx
pop ecx
test eax, eax
push 1
je 0x412812
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp + 8]
call fcn.004014ff
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
je 0x412804
mov al, byte [ebp + 0xb]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x24], al
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x4c]
push eax
push 0x2c
mov byte [ebp - 4], 1
call fcn.004174dd
mov dword [ebp - 0x14], ebx
xor esi, esi
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x4127f9
mov eax, dword [ebp - 0x1c]
push 0x28
sub eax, ecx
pop edi
cdq
idiv edi
cmp dword [ebp - 0x14], eax
jae 0x4127f9
add ecx, esi
call fcn.004016f0
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1ec]
push 0x43bb30
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2f0]
push 1
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.00415586
test eax, eax
je 0x4127d6
inc dword [ebp - 0x14]
add esi, edi
jmp 0x412775
mov ecx, dword [ebp - 0x10]
call fcn.004171c4
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004178fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040191f
xor eax, eax
jmp 0x412813
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004178fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040191f
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
push 0x43bb40
push dword [ebp + 8]
call fcn.00426680
pop ecx
test eax, eax
pop ecx
jne 0x412810
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x3f4]
push 1
push eax
push 0x43bb30
call fcn.00415586
test eax, eax
jne 0x412810
mov ecx, dword [ebp - 0x10]
call fcn.004171c4
jmp 0x4127f5
Function at 0x412d3b
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
mov eax, 0x432848
call fcn.00425db8
sub esp, 0x118
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
push 1
pop esi
cmp ecx, 0x2000
mov dword [eax], esi
je 0x412db6
cmp ecx, 0xbc2
je 0x412db6
xor ebx, ebx
cmp ecx, 0x800704c7
je 0x412d7d
cmp ecx, 0x642
jne 0x412d89
cmp dword [ebp + 0x18], ebx
je 0x412d89
mov dword [eax], ebx
jmp 0x412eb0
cmp ecx, ebx
je 0x412eb0
cmp ecx, 0x1008
je 0x412eb0
mov ecx, dword [ebp - 0x10]
mov dword [0x443124], 0x66d
call fcn.004171c4
xor eax, eax
jmp 0x412eb2
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
mov ecx, dword [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0x43bd44
push 0x43bd30
push dword [0x43466c]
call fcn.00401046
mov ecx, eax
add ecx, 0x4020
call fcn.00402344
cmp byte [ebp - 0x20], 0x59
mov byte [ebp + 0x17], bl
je 0x412e01
cmp byte [ebp - 0x20], 0x79
jne 0x412e05
mov byte [ebp + 0x17], 1
call fcn.0041fc1c
test eax, eax
jne 0x412e27
cmp dword [ebp + 8], 0xbc2
jne 0x412e1c
cmp byte [ebp + 0x17], bl
je 0x412e27
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x412e31
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x18], ebx
mov dword [eax + 0x38], esi
push 0x20019
push 0x43bcfc
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], ebx
call fcn.0040f9b2
test eax, eax
jne 0x412ea1
push 0x40
lea edi, [ebp - 0x123]
pop ecx
mov byte [ebp - 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
push 0x43bce8
mov dword [ebp + 0xc], ebx
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 0x18], ebx
pop edi
je 0x412eb0
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x4151d3
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and byte [ebp - 0x108], 0
push ebx
push esi
push edi
mov esi, ecx
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov ebx, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
and dword [ebx], 0
and byte [ebp + 0xf], 0
stosw word es:[edi], ax
mov ecx, esi
stosb byte es:[edi], al
call fcn.00401046
add eax, 0xac
push eax
push 0x43c0fc
call fcn.0041f933
pop ecx
test eax, eax
pop ecx
jge 0x41523e
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x43c0f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, 0x43c0f0
jmp 0x41528d
mov ecx, esi
mov byte [ebp + 0xf], 1
call fcn.00401046
mov ecx, eax
call fcn.0041c594
push dword [ebp + 8]
test eax, eax
je 0x415273
lea eax, [ebp - 0x108]
push 0x43c0d8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, 0x43c0c4
jmp 0x41528d
lea eax, [ebp - 0x108]
push 0x43c0a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, 0x43c088
mov ecx, esi
call fcn.00401046
mov ecx, eax
call fcn.0041c594
test eax, eax
je 0x4152b4
mov ecx, esi
call fcn.00401046
push eax
push 1
push edi
push dword [ebp + 8]
call fcn.0042015c
jmp 0x4152c2
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.0041fa3d
mov esi, eax
test esi, esi
je 0x415380
cmp esi, 0xbc2
je 0x4152ef
push 0
push esi
mov dword [0x443124], 0x484
call fcn.0041edb6
pop ecx
mov eax, esi
pop ecx
jmp 0x415382
cmp byte [ebp + 0xf], 0
je 0x41537a
and dword [ebp + 8], 0
push 0x20019
push 0x43bcfc
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 8]
mov dword [ebx], 2
call fcn.0040f9b2
test eax, eax
jne 0x415369
and byte [ebp - 0x20c], al
push 0x40
pop ecx
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x43bce8
mov dword [ebp + 0xc], 0x104
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 8], 0
je 0x415380
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x415380
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x416674
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x432b0e
call fcn.00425db8
sub esp, 0x18c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x12]
mov ebx, 0x43447c
mov esi, 0x434474
push edi
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x4c], esi
call fcn.00401581
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
call fcn.0041687b
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004016f0
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4166fd
lea ecx, [ebp - 0x10]
call fcn.0040a986
mov ecx, dword [ebp + 0xc]
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
sete byte [ebp + 0xf]
call fcn.0040191f
cmp byte [ebp + 0xf], 0
je 0x416833
and byte [ebp - 0x198], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
and dword [ebp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x104
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0x43c1fc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41677d
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.00401581
mov dword [ebp - 0x18], 1
jmp 0x41684f
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x44]
call fcn.004014ff
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 4
call fcn.0040b9af
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0040191f
mov eax, 0x43c1f8
mov dword [ebp - 0x44], ebx
mov ecx, eax
mov dword [ebp - 0x24], esi
test ecx, ecx
mov edi, 0x440144
jne 0x4167c6
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0040ba8c
mov eax, 0x43c1f4
mov byte [ebp - 4], 5
mov ecx, eax
mov dword [ebp - 0x94], ebx
test ecx, ecx
mov dword [ebp - 0x74], esi
jne 0x4167ef
mov eax, edi
lea ecx, [ebp - 0x11]
push 0
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.0040ba8c
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 6
call fcn.004175ae
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.0040191f
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0040191f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.0040b9f9
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0040191f
cmp dword [ebp - 0x10], 0
je 0x41686a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c1cf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
mov esi, 0x43c788
push edi
lea eax, [ebp - 0x14]
push esi
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 4
xor ebx, ebx
pop eax
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x44d4]
push 0x7f00
push ebx
mov dword [ebp - 0x50], 0x41c327
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [edi + 0x44d4]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0x41c252
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x41c2f4
push 0xd0
call fcn.00425dd7
mov esi, eax
pop ecx
cmp esi, ebx
je 0x41c2f4
mov eax, dword [ebp + 8]
push 1
pop ecx
mov dword [esi + 4], ecx
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 8], edx
mov eax, dword [eax]
mov dword [esi + 0x78], eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [esi]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
sub eax, dword [ebp - 0x28]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call ebx
sub eax, dword [ebp - 0x24]
push esi
push dword [edi + 0x44d4]
xor ecx, ecx
cdq
push ecx
push ecx
push dword [ebp - 0x24]
sub eax, edx
sar eax, 1
push dword [ebp - 0x28]
mov dword [edi + 0x4094], ecx
push eax
push dword [ebp + 8]
push 0x86000000
push 0x43c778
push 0x43c788
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
test ebx, ebx
jne 0x41c2f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x41c320
push esi
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
push ebx
mov dword [edi + 0x4094], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x4094]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41c67a
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x433262
call fcn.00425db8
sub esp, 0x4a4
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x4af]
mov byte [ebp - 0x4b0], bl
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4b0]
lea ecx, [esi + 0x4020]
push eax
push 0x440140
push 0x43c7ac
push 0x43b1fc
call fcn.00402344
cmp byte [ebp - 0x4b0], bl
jne 0x41c6de
xor eax, eax
jmp 0x41c7de
push 1
lea eax, [ebp - 0xe]
pop edi
mov ecx, esi
push edi
push eax
call fcn.0041ab37
push eax
lea ecx, [ebp - 0x38]
call fcn.004014ff
lea eax, [ebp - 0xd]
push edi
push eax
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.004014ff
push ebx
lea eax, [ebp - 0x88]
push ebx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040b1c2
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, eax
call fcn.0040b0e0
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.0040b9af
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.0040191f
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.0040191f
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.0040191f
lea ecx, [ebp - 0x38]
call fcn.004016f0
push eax
call fcn.0041f825
test eax, eax
jne 0x41c7af
lea eax, [ebp - 0xd]
push edi
push eax
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x60]
call fcn.004014ff
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 4], 4
call fcn.0040b9af
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.0040191f
push edi
push ebx
push ebx
lea ecx, [ebp - 0x38]
call fcn.004016f0
push eax
push 0x43c7c0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x38]
sbb esi, esi
or dword [ebp - 4], 0xffffffff
neg esi
call fcn.0040191f
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41e9da
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
mov dword [ebp - 4], ecx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x41ea06
xor eax, eax
jmp 0x41eab6
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x41eaab
push esi
mov esi, dword [eax + 0x3c]
add esi, eax
push edi
mov edi, dword [esi + 0xa8]
cmp edi, ebx
mov dword [ebp - 0xc], edi
je 0x41eaa0
mov ecx, dword [ebp - 4]
push esi
push 0x43c8c4
call fcn.0041eabb
cmp eax, ebx
je 0x41ea56
cmp dword [eax + 0xc], edi
jne 0x41ea56
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0xac]
add ecx, dword [ebp + 8]
jmp 0x41ea87
mov ecx, dword [ebp - 4]
push esi
push 0x43c8bc
call fcn.0041eabb
mov edi, eax
cmp edi, ebx
je 0x41eaa0
mov eax, dword [esi + 0xac]
push 0x1c
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
je 0x41eaa0
mov ecx, dword [edi + 0x14]
sub ecx, dword [edi + 0xc]
add ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
cmp eax, ebx
jbe 0x41ea9b
mov edx, dword [ebp - 8]
add ecx, 0x10
add edx, dword [ecx]
add ecx, 0x1c
dec eax
jne 0x41ea91
jmp 0x41ea9e
mov edx, dword [ebp - 8]
mov ebx, edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 4