joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421550
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x620]
push eax
push 0x20019
push 0
push 0x480e34
push Ordinal_2
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4215b4
cmp eax, 2
jne 0x4215a9
call fcn.00421360
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov ecx, dword [ebp - 0x620]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
lea edx, [ebp - 0x620]
push edx
push 0x20019
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
test eax, eax
je 0x42161b
cmp eax, 2
jne 0x421610
call fcn.00420d70
test eax, eax
jne 0x4215f5
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov edx, dword [ebp - 0x620]
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0
push edx
mov dword [ebp - 0x624], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
mov eax, dword [ebp - 0x620]
push eax
call edi
test esi, esi
je 0x42168a
cmp esi, 2
jne 0x42167f
call fcn.00420d70
test eax, eax
jne 0x421664
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push str.__s_____1_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x61c]
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4216ec
test dx, dx
je 0x4216e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4216ec
add eax, 4
add ecx, 4
test dx, dx
jne 0x4216c6
xor eax, eax
jmp 0x4216f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42170d
call fcn.00420d70
test eax, eax
jne 0x421703
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
lea esi, [ebp - 0x20c]
mov eax, esi
lea edx, [eax + 2]
jmp 0x421720
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421720
sub eax, edx
sar eax, 1
dec eax
js 0x421756
mov ecx, 0x5c
jmp 0x421740
cmp word [ebp + eax*2 - 0x20c], cx
je 0x42174f
dec eax
jns 0x421740
jmp 0x421756
lea esi, [ebp + eax*2 - 0x20a]
push esi
mov edi, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.00421450
push esi
mov edi, reloc.EpicWrapperDll.dll_Ordinal_1
call fcn.00421450
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x421bb0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.0043e6c0
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x100
lea eax, [ebp - 0x40c]
xor edi, edi
push eax
push edi
mov dword [ebp - 0x1410], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x40c]
push 0x5c
push ecx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
mov ebx, eax
add esp, 8
cmp ebx, edi
jne 0x421c04
lea ebx, [ebp - 0x40c]
jmp 0x421c07
add ebx, 2
lea edx, [ebp - 0x1418]
push edx
push 0x1000
lea eax, [ebp - 0x140c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x421d4a
mov eax, dword [ebp - 0x1418]
shr eax, 2
mov dword [ebp - 0x1414], eax
cmp eax, edi
jbe 0x421d4a
push esi
mov esi, dword [ebp + edi*4 - 0x140c]
test esi, esi
je 0x421d33
mov eax, dword [0x482300]
mov ecx, dword [str._unknown_]
mov edx, dword [0x4822fc]
push 0x1f4
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x20c], ecx
mov ecx, dword [0x482304]
mov dword [ebp - 0x208], edx
mov edx, dword [0x482308]
lea eax, [ebp - 0x1f8]
push 0
push eax
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0x1fc], edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421d26
lea ecx, [ebp - 0x1420]
push ecx
push 4
lea edx, [ebp - 0x141c]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x421d26
mov ecx, dword [ebp - 0x141c]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
mov ecx, ebx
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421d17
test dx, dx
je 0x421d13
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421d17
add eax, 4
add ecx, 4
test dx, dx
jne 0x421cf1
xor eax, eax
jmp 0x421d1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x421d26
inc dword [ebp - 0x1410]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1414]
inc edi
cmp edi, eax
jb 0x421c40
mov eax, 1
pop esi
cmp dword [ebp - 0x1410], eax
jg 0x421d4c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x424cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 8
mov esi, str.C:SoraStreamSorastreamPlatform_
mov edi, 0x4a3188
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x47d814
movsw word es:[edi], word [esi]
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x424da2
mov edx, dword [ebp - 0x808]
push eax
push eax
push 0x800
lea ecx, [ebp - 0x804]
push ecx
push 0xffffffffffffffff
push edx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push str.Logs
push 0x482e38
push str.LudiumLab
lea eax, [ebp - 0x804]
push eax
push str._s_s_s_s
push 0x4a3988
call esi
push str.Baldrick.exe
push 0x4a3188
push str._sSoftware_s
push 0x4a4188
call esi
push str.TFormation_Win32.dll
push 0x4a3188
push str._sSoftware_s
push 0x4a4988
call esi
push str.TFormation_x64.dll
push 0x4a3188
push str._sSoftware_s
push 0x4a5188
call esi
add esp, 0x48
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x424dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.0043e6c0
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 0x1034]
push ecx
mov dword [ebp - 0x1038], eax
call dword [sym.imp.MSVCR100.dll__ftime64]
lea edx, [ebp - 0x1034]
push edx
lea eax, [ebp - 0x24]
push 0x1a
push eax
call dword [sym.imp.MSVCR100.dll__ctime64_s]
mov edx, dword [esi*4 + 0x4a2abc]
push ebx
push edi
lea ecx, [ebp - 0x24]
push ecx
push edx
push str._s:_t_.24s_t__s__t_s_n
lea eax, [ebp - 0x1024]
push 0xfff
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
mov esi, eax
add esp, 0x2c
cmp esi, 0xffffffff
jne 0x424e37
mov esi, 0xfff
mov eax, dword [ebp - 0x1038]
push 0
lea ecx, [ebp - 0x103c]
push ecx
mov ecx, dword [eax + 8]
push esi
lea edx, [ebp - 0x1024]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp + esi - 0x1024], 0
test eax, eax
jne 0x424e8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ss_log_write_simple_failed_with_error__d__n
call dword [sym.imp.libssclient.dll_ss_OutputDebugStringA]
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x95a0a0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0095a1f0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x95a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95a0b2
add dl, dl
jne 0x95a0d1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95a124
xor eax, eax
add dl, dl
jne 0x95a0de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95a1c5
add dl, dl
jne 0x95a0ed
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95a0f8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95a103
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x95a11a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x95a0bd
mov eax, 1
add dl, dl
jne 0x95a132
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95a13d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95a129
sub eax, ebx
mov ebx, 1
jne 0x95a170
mov ecx, 1
add dl, dl
jne 0x95a156
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95a161
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95a14d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95a0bd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95a187
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95a192
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95a17e
cmp eax, 0x7d00
jae 0x95a1b5
cmp eax, 0x500
jb 0x95a1b0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95a0bd
cmp eax, 0x7f
ja 0x95a1b8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95a0bd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95a1e6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x95a0bd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
invalid
invalid
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4017d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [0x848520], 0x400
push esi
push edi
jne 0x40182b
push 0
call dword [sym.imp.USER32.dll_WindowFromDC]
push 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
lea esi, [ebp - 0x24]
call fcn.00401920
mov ecx, esi
call fcn.00401940
mov edi, dword [ebp - 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffA]
xor esi, esi
cmp esi, 0xa50
jge 0x40184a
push 0
lea ecx, [ebp - 0x424]
push ecx
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2af68b
jle 0x401860
cmp edi, 0x78d9a205
jne 0x401869
inc esi
cmp esi, 0x1c5d
jl 0x401837
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
xor esi, esi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call ebx
cmp esi, 0x206d47
jg 0x401896
inc esi
cmp esi, 0x4f6a4
jl 0x401877
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x4018b5
cmp ebx, 0x785074d5
jne 0x4018be
inc esi
cmp esi, 0x11915
jl 0x4018a1
mov edx, dword [0x42939c]
mov dword [0x848520], edx
call fcn.00401560
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov edi, 0x3078f
pop ebx
jmp 0x4018e0
cmp dword [0x848520], 0x51f
jne 0x4018fc
push 0
lea eax, [ebp - 0x824]
push eax
push 0x425dd4
call esi
sub edi, 1
jne 0x4018e0
mov eax, dword [0x847474]
mov dword [0x847ab4], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4042eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4287a8]
jne 0x4042f5
repz ret
jmp fcn.00408dec
Function at 0x40b17a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f96
and dword [ebp - 4], 0
cmp dword [0x42a22c], 0
mov ebx, eax
jne 0x40b22b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b2dc
push eax
call fcn.00404f24
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42a22c], eax
call esi
push eax
call fcn.00404f24
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42a230], eax
call esi
push eax
call fcn.00404f24
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42a234], eax
call esi
push eax
call fcn.00404f24
pop ecx
mov dword [0x42a23c], eax
test eax, eax
je 0x40b22b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f24
pop ecx
mov dword [0x42a238], eax
mov eax, dword [0x42a238]
cmp eax, ebx
je 0x40b283
cmp dword [0x42a23c], ebx
je 0x40b283
push eax
call fcn.00404f9f
push dword [0x42a23c]
mov esi, eax
call fcn.00404f9f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b283
test edi, edi
je 0x40b283
call esi
test eax, eax
je 0x40b27a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b27a
test byte [ebp - 0xc], 1
jne 0x40b283
or dword [ebp + 0x10], 0x200000
jmp 0x40b2bc
mov eax, dword [0x42a230]
cmp eax, ebx
je 0x40b2bc
push eax
call fcn.00404f9f
pop ecx
test eax, eax
je 0x40b2bc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2bc
mov eax, dword [0x42a234]
cmp eax, ebx
je 0x40b2bc
push eax
call fcn.00404f9f
pop ecx
test eax, eax
je 0x40b2bc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a22c]
call fcn.00404f9f
pop ecx
test eax, eax
je 0x40b2dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b2de
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x104
push eax
push 1
push 0
push 0x10001cc8
push 0x80000002
mov esi, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003e2d
lea eax, [ebp - 8]
push eax
push esi
push 0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegQueryValueA]
test eax, eax
jne 0x10003e24
cmp dword [ebp - 8], eax
je 0x10003e24
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x10003e2f
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007800
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10007816
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10007831
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1000d42e
Capabilities:
Encode data using xor

Disassembly:
call 0x1000d3a7
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1000d3d7
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1000d3f3
xor edx, 0
jmp 0x1000d3fe
xor edx, edx
jmp 0x1000d415
jmp 0x1000d421
xor eax, eax
push 0x8427d7c0
call 0x1000d42e
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1000d46a
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1000d443
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1000d481
add eax, 0
jno 0x1000d486
add esi, 0
ret 0x10
Function at 0x1000e1ef
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1000e211
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1000e3b3
cmp edi, dword [ebp + 0x10]
jb 0x1000e3b3
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1000dcdb
inc edi
jmp 0x1000e29a
jmp 0x1000e2a7
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1000dcdb
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1000dcdb
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1000e2fb
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1000e2df
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1000e329
add dword [eax], 0x39
jle 0x1000e305
sub al, 0xf5
mov ch, al
call fcn.1000e33e
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x10010016
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1001002c
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1001003d
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1001007e
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx