joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5174c0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.005174a0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x51758c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004a6f60
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.004a6eb0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.004a7670
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.004a8b20
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x5175e3
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.00517480
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00517480
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.005174a0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x548610
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.005485f0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040ab10
cmp dword [ebp - 0xc], 0
jle 0x548678
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x54866c
mov eax, 0x6052f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040ab10
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b290
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x5486a1
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x5486ad
mov eax, 0x6052f0
call fcn.004a4f90
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005485f0
mov esp, ebp
pop ebp
ret
Function at 0x549ad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, ecx
mov edx, 0x5e9588
call fcn.0040ebc0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00549ac0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
add eax, 0x34
xor edx, edx
call fcn.00408d80
mov eax, dword [ebp - 0xc]
mov edx, fcn.00514400
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.004096d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 0x30
call fcn.00408d80
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00547d20
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a140
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
jne 0x549bec
mov eax, dword [ebp - 4]
call fcn.0048a5e0
test al, al
jne 0x549bec
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00549ac0
mov esp, ebp
pop ebp
ret
Function at 0x563b20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
call fcn.0040e1d0
lea eax, [ebp - 0x28]
call fcn.0040e1d0
lea eax, [ebp - 0x38]
call fcn.0040e1d0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
lea eax, [ebp - 0x68]
call fcn.0040e1d0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
xor eax, eax
push fcn.00563ac0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x5f2f54
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0xb
lea edx, [ebp - 0x54]
xor ecx, ecx
mov eax, str.winmgmts:___s_root_CIMV2
call fcn.0043fba0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.005639c0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x18]
call fcn.0040e2f0
lea eax, [ebp - 0x68]
call fcn.0040e1e0
mov dword [ebp - 0x74], 0
mov eax, 0x5f2f8c
mov dword [ebp - 0x70], eax
mov eax, 0x5f2f98
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x5f2f10
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x68]
call fcn.0040e300
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x28]
call fcn.0040e220
mov ebx, 0x5f2fd0
lea eax, [ebp - 0x68]
call fcn.0040e1e0
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x5f2f20
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x68]
call fcn.0040e300
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x7c]
call fcn.0040e2c0
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
mov edx, ebx
call fcn.0040d3b0
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x3c]
call fcn.0040d380
jmp 0x563c6f
lea eax, [ebp - 0x68]
call fcn.0040e1e0
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x5f2f2c
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x68]
call fcn.0040e300
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x40]
call fcn.00563950
lea ebx, [ebp - 0x38]
mov eax, ebx
call fcn.0040e1e0
lea eax, [ebp - 0x44]
push eax
push ebx
push 1
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x563c48
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x40]
call fcn.00408d80
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00563ac0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x564880
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [0x5f32f8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 8], 0
xor eax, eax
push 0x564935
push ebp
push 0x4153f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
setne al
mov byte [ebp - 0x38], al
test al, al
je 0x564918
lea eax, [ebp - 0x18]
push eax
mov eax, str.SeShutdownPrivilege
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
or eax, eax
setne al
mov byte [ebp - 0x38], al
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], 0x10
cmp byte [ebp - 0x38], 0
je 0x564918
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0xc]
call sub.advapi32.dll_AdjustTokenPrivileges
mov esi, esi
push 0
push dword [ebp - 4]
call sub.user32.dll_ExitWindowsEx
or eax, eax
setne al
mov byte [ebp - 8], al
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x564944
mov al, byte [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x566db0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
xor eax, eax
push fcn.00566d90
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.00566d70
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push 0x5f4af0
push ebp
push 0x415450
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x566e3a
mov eax, 0x6052f0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
test eax, eax
jbe 0x566ec6
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.0040fe10
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x566e6b
mov eax, 0x6052f0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x566ef5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, 0x5f4c8c
push eax
push dword [ebp - 0x18]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x566ef5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
xor edx, edx
or eax, dword [ebp - 0x10]
or edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov esi, esi
jmp 0x566ef5
lea eax, [ebp - 0x28]
call fcn.00403e70
push 0
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x2c]
call fcn.00449000
mov ecx, dword [ebp - 0x2c]
mov edx, str.TWVLoader.GetExtendedFileVersion_error:
lea eax, [ebp - 0x28]
call fcn.00408e80
mov eax, dword [ebp - 0x28]
call fcn.0057e020
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x566f1d
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00566d70
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00566d90
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x150]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov byte [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov dword [ebp - 0x14c], 0
xor eax, eax
push fcn.00567360
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push 0x5f4b20
push ebp
push 0x415450
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.0043de50
test al, al
je 0x567480
push 0x20
mov ecx, dword [ebp - 4]
mov edx, 1
mov eax, 0x5a43ac
call fcn.0042c0b0
mov dword [ebp - 0x14c], eax
xor cx, cx
xor edx, edx
mov ebx, dword [ebp - 0x14c]
mov ebx, dword [ebx]
call dword [ebx + 0x88]
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x14c]
mov ecx, 0x40
call fcn.0042bbb0
cmp word [ebp - 0x50], 0x5a4d
jne 0x567480
cmp dword [ebp - 0x14], 0
je 0x567480
mov edx, dword [ebp - 0x14]
mov eax, edx
sar eax, 0x1f
push eax
push edx
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x14c]
mov edx, dword [edx]
call dword [edx + 0x6c]
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x14c]
mov ecx, 0xf8
call fcn.0042bbb0
cmp dword [ebp - 0x148], 0x4550
jne 0x567480
movzx eax, word [ebp - 0x144]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov byte [ebp - 0x10], 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x5674ad
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00567360
mov al, byte [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56da60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x56da84
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x56db76
mov esi, esi
xor eax, eax
push 0x56db57
push ebp
push 0x4153f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 8]
xor eax, eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x3c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x29], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x28], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x24], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x25], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x26], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x56db4c
cmp dword [ebp - 4], 0
je 0x56db4c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x56db76
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56e700
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, esi
xor edx, edx
call fcn.00408d80
mov eax, 0
test ebx, ebx
jne 0x56e720
mov ebx, 0x6052f0
push ebx
call sub.ws2_32.dll_gethostbyname
test eax, eax
je 0x56e738
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, esi
mov eax, dword [eax]
call fcn.0056e840
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56eae0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x5751f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, esi
xor cl, cl
mov edx, 0x20
call fcn.004039d0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0
lea eax, [esi + 4]
push eax
mov eax, esi
push eax
push 0
push 0
push 0
push dword [ebx + 0x14]
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebx + 4], eax
test eax, eax
sete bl
jne 0x575258
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.00442350
fstp qword [esi + 0x18]
mov esi, esi
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x575610
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
xor eax, eax
push fcn.005755f0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
mov edx, 0x5fd1c8
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.0040cf00
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.005751f0
test al, al
je 0x575780
cmp dword [ebp - 0x28], 0
jle 0x575780
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x2c], eax
mov edx, eax
shl edx, 1
lea eax, [ebp - 0x30]
call fcn.0040fe10
xor eax, eax
push fcn.005755e0
push ebp
push 0x415070
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
mov edx, 0x5fd1c8
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.0040cf00
mov eax, dword [ebp - 0x28]
lea ebx, [eax - 1]
mov dword [ebp - 0x34], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x38], eax
cmp eax, 0x103
je 0x57576d
cmp dword [ebp - 0x38], 0
je 0x575734
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x44]
call fcn.00449000
mov ecx, dword [ebp - 0x44]
mov edx, 1
mov eax, 0x5fcf98
call fcn.00446a40
mov edx, 0x57570a
mov ecx, ebp
call fcn.00414f30
nop
cmp dword [ebp - 0x2c], 0
jne 0x575746
lea eax, [ebp - 0x3c]
xor edx, edx
call fcn.0040b320
jmp 0x575751
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
call fcn.0040b2d0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x3c]
call fcn.0040b320
cmp ebx, dword [ebp - 0x34]
ja 0x5756d0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005755e0
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005755f0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40473b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4054f0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x401a90
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x401a57
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x401a81
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x401a96
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x401a96
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4054c4
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x4054b0
mov dword [esp + 0x1c], 0xffffffff
call fcn.00404258
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x402140
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea eax, [esp + 8]
mov edx, dword [esi + 4]
lea edi, [esi + 0x1c]
push edi
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4021a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4021a0
mov eax, dword [esi + 0x2c]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4021a0
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [esi + 0x24], ecx
pop edi
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x402200
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
je 0x402283
mov eax, dword [esi + 4]
test eax, eax
je 0x402283
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402283
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], eax
cmp ecx, eax
jge 0x40223f
mov eax, ecx
mov dword [esp + 4], eax
lea ecx, [esi + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402278
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402283
mov edx, dword [esi + 0x18]
push 0x7d0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
pop esi
add esp, 0x14
ret 8
xor eax, eax
pop esi
add esp, 0x14
ret 8
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xc50095
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6d8c495e
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10001494
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x100014de
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
call eax
mov ecx, esp
mov dword [ecx + 4], 0xc7e
mov dword [ecx], 0xe22d90
mov ecx, dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov word [esp + 0x1a], ax
call ecx
sub esp, 8
mov dword [esp + 0x14], eax
mov eax, 0x4e
mov dword [esp + 0x1c], eax
jmp 0x100014de
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
mov ecx, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [esp + 0x10], eax
call ecx
sub esp, 4
mov eax, dword [esp + 0x10]
cmp eax, 0x4d
je 0x100014a5
mov eax, dword [esp + 0x10]
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp eax, 0xb0
mov dword [esp + 0x1c], eax
je 0x100014da
jmp 0x100014de