joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401810
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d068]
test esi, esi
jle 0x401930
mov eax, dword [0x40d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401844
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401830
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401957
mov eax, dword [0x40d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401937
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018d0
add dword [0x40d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40184e
mov eax, dword [0x40d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d07c]
sub esp, 4
test ebx, ebx
je 0x401ec5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401ebe
test esi, esi
je 0x401ebe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ea0
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x683b29af
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6d00342f
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4035d8
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1804
call fcn.0040a120
mov eax, dword [0x24619ec]
mov ecx, dword [0x246147c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4036b3
mov edi, ecx
mov ebx, eax
cmp dword [0x24619ec], 0x959
jne 0x4036a3
push esi
lea eax, [esp + 0x814]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x403198
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x1014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call fcn.004033b7
add edi, 8
dec ebx
jne 0x403607
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407a1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437bf0]
jne 0x407a28
repz ret
jmp fcn.00409a0c

Function at 0x40839c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405432
and dword [ebp - 0x14], 0
cmp dword [0x44ef84], 0
mov dword [ebp - 0x18], eax
jne 0x40844f
push 0x40295c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4084f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402950
push ebx
call edi
test eax, eax
je 0x4084f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402940
push ebx
mov dword [0x44ef84], eax
call edi
push eax
call esi
push 0x40292c
push ebx
mov dword [0x44ef88], eax
call edi
push eax
call esi
push 0x402910
push ebx
mov dword [0x44ef8c], eax
call edi
push eax
call esi
mov dword [0x44ef94], eax
test eax, eax
je 0x40844f
push 0x4028f8
push ebx
call edi
push eax
call esi
mov dword [0x44ef90], eax
mov eax, dword [0x44ef90]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4084a8
cmp dword [0x44ef94], ecx
je 0x4084a8
push eax
call esi
push dword [0x44ef94]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4084a8
test ebx, ebx
je 0x4084a8
call edi
test eax, eax
je 0x40849f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40849f
test byte [ebp - 8], 1
jne 0x4084a8
or dword [ebp + 0x10], 0x200000
jmp 0x4084db
mov eax, dword [0x44ef88]
cmp eax, dword [ebp - 0x18]
je 0x4084db
push eax
call esi
test eax, eax
je 0x4084db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4084db
mov eax, dword [0x44ef8c]
cmp eax, dword [ebp - 0x18]
je 0x4084db
push eax
call esi
test eax, eax
je 0x4084db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44ef84]
call esi
test eax, eax
je 0x4084f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4084f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407a1e
leave
ret
Function at 0x4010e0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010f2
mov eax, dword [0x44908b]
shl eax, 2
mov dword [0x44908f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004082e8
pop edx
call fcn.00407684
call fcn.004082ec
push 0
call fcn.0040983c
pop ecx
push 0x449034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x449093], eax
push 0
jmp fcn.0040ff54
Function at 0x402210
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004015bc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x4022c3
mov eax, fcn.00406508
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4022c3
mov eax, fcn.00402430
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4022c3
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4022c3
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x40228b
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4022e0
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004015bc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x402396
mov eax, fcn.00406508
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x402396
mov eax, fcn.004022e0
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x402396
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x402396
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x40235e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402480
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004015bc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x402536
mov eax, fcn.00406508
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x402536
mov eax, fcn.00402430
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x402536
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x402536
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4024fe
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4027d0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
mov ecx, 0x82
lea eax, [ebp - 0x208]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, str.SetupApi.dll
push esi
lea edi, [ebp - 0x208]
mov esi, 0x449600
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x410]
push esi
mov esi, 0x449809
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x104
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push esi
lea edx, [ebp - 0x208]
push edx
call sub.KERNEL32.DLL_lstrcatA
push 8
push 0
lea ecx, [ebp - 0x208]
push ecx
call sub.KERNEL32.DLL_LoadLibraryExA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
je 0x40288a
lea eax, [esi + 0xe]
push eax
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f74], eax
lea edx, [esi + 0x23]
push edx
mov ecx, dword [ebx + 8]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f78], eax
lea eax, [esi + 0x3f]
push eax
mov edx, dword [ebx + 8]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f7c], eax
lea ecx, [esi + 0x60]
push ecx
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f80], eax
jmp 0x4028a5
push 0x10
lea edx, [esi + 0x82]
push edx
lea ecx, [esi + 0x7d]
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x402998
push 0x104
lea edx, [ebp - 0x410]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea ecx, [esi + 0x9d]
push ecx
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 8
push 0
lea edx, [ebp - 0x410]
push edx
call sub.KERNEL32.DLL_LoadLibraryExA
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
je 0x402978
lea eax, [esi + 0xa6]
push eax
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f84], eax
lea edx, [esi + 0xb6]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f88], eax
lea eax, [esi + 0xc6]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f8c], eax
lea ecx, [esi + 0xd6]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f90], eax
lea edx, [esi + 0xec]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f94], eax
lea eax, [esi + 0xff]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f98], eax
lea ecx, [esi + 0x116]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4f0f9c], eax
jmp 0x402993
push 0x10
lea edx, [esi + 0x129]
push edx
lea ecx, [esi + 0x123]
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x402998
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403224
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
mov eax, dword [ebp + 0xc]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4032c2
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00408788
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x110]
push eax
push 0x449bc3
call fcn.00408a08
add esp, 0xc
test eax, eax
jne 0x4032c2
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
jne 0x4032bf
push 0x449bef
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x110]
push eax
mov edx, dword [ebp + 0x14]
push edx
call sub.KERNEL32.DLL_lstrcatA
mov eax, 1
jmp 0x4032cd
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x403240
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403fe8
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x404057
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40401f
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404bd0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
push esi
cmp dword [ebp + 0xc], 0
je 0x404bf6
lea eax, [ebp - 0x45c]
push eax
call fcn.00404dd8
pop ecx
test eax, eax
jne 0x404cb5
push 0x400
push 0
lea edx, [ebp - 0x45c]
push edx
call fcn.00408608
add esp, 0xc
lea ecx, [ebp - 0x45c]
push ecx
push 0x1ff
call sub.KERNEL32.DLL_GetTempPathA
push str.YShow3D.exe
lea eax, [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_lstrcatA
xor edx, edx
mov dword [ebp - 8], edx
push 4
push 0x44aa8c
lea ecx, [ebp - 8]
push ecx
call fcn.00408598
add esp, 0xc
push 4
push 0x1000
mov eax, dword [ebp - 8]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
test ebx, ebx
jne 0x404c65
xor eax, eax
jmp 0x404d33
push 0x283d2
lea edx, [ebp - 8]
push 0x44aa90
push edx
push ebx
call fcn.00415684
add esp, 0x10
lea ecx, [ebp - 0x45c]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x404cb5
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
push edx
push ebx
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp + 8]
push ecx
lea eax, [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x44
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.00408608
add esp, 0xc
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
push 0x10
push 0
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00408608
add esp, 0xc
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x45c]
push eax
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x404d23
xor eax, eax
jmp 0x404d33
push 0xffffffffffffffff
mov edx, dword [ebp - 0x5c]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406364
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x4ceb3f]
mov edx, dword [0x4ceb47]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4ceb43]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x4ceb4b]
mov dword [0x4f0f6c], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4064a8
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x406413
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4064aa
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00408860
add esp, 0xc
test eax, eax
je 0x40642d
xor eax, eax
jmp 0x4064aa
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x406456
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4064aa
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x44916c], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x44916c]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4064a1
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4064aa
mov eax, 1
jmp 0x4064aa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4064b4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x354]
push eax
lea edx, [ebx + 0x21a]
push edx
lea ecx, [ebx + 0x24c]
push ecx
push 0
call fcn.00404d3c
add esp, 0x10
cmp byte [ebx + 0x350], 0
jne 0x406502
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop ebx
pop ebp
ret