joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a718
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
test eax, eax
jle 0x46a768
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
call fcn.004787fc
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
xor byte [edx], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [eax]
xor eax, eax
call fcn.004785d4
mov eax, dword [ebp + 8]
inc dword [eax - 4]
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x46a73e
pop ecx
pop ecx
pop ebp
ret

Function at 0x47491c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x474968
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
xor eax, edx
and eax, 0xff
mov edx, dword [0x48eb54]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 8
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jg 0x474931
mov esp, ebp
pop ebp
ret

Function at 0x475ac8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x475c28
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x475f20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.00404b10
mov esp, ebp
pop ebp
ret

Function at 0x475f54
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x475f70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x476158
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x476200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x476358
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x476508
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x47652c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x476572
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476579
lea eax, [ebp - 4]
call fcn.00404a20
ret

Function at 0x4765dc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4785d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47868e
mov eax, dword [0x48e93c]
mov eax, dword [eax]
xor edx, edx
mov dl, byte [ebp - 2]
xor eax, edx
and eax, 0xff
mov edx, dword [0x48eb04]
mov eax, dword [edx + eax*4]
mov edx, dword [0x48e93c]
mov edx, dword [edx]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [0x48e93c]
mov dword [edx], eax
mov eax, dword [0x48e93c]
mov eax, dword [eax]
and eax, 0xff
mov edx, dword [0x48e93c]
add dword [edx + 4], eax
mov eax, dword [0x48e93c]
imul eax, dword [eax + 4], 0x8088405
inc eax
mov edx, dword [0x48e93c]
mov dword [edx + 4], eax
mov eax, dword [0x48e93c]
mov eax, dword [eax + 8]
mov edx, dword [0x48e93c]
mov edx, dword [edx + 4]
shr edx, 0x18
xor eax, edx
and eax, 0xff
mov edx, dword [0x48eb04]
mov eax, dword [edx + eax*4]
mov edx, dword [0x48e93c]
mov edx, dword [edx + 8]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [0x48e93c]
mov dword [edx + 8], eax
pop ecx
pop ebp
ret
mov eax, dword [0x48ea34]
mov eax, dword [eax]
xor edx, edx
mov dl, byte [ebp - 2]
xor eax, edx
and eax, 0xff
mov edx, dword [0x48eb04]
mov eax, dword [edx + eax*4]
mov edx, dword [0x48ea34]
mov edx, dword [edx]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [0x48ea34]
mov dword [edx], eax
mov eax, dword [0x48ea34]
mov eax, dword [eax]
and eax, 0xff
mov edx, dword [0x48ea34]
add dword [edx + 4], eax
mov eax, dword [0x48ea34]
imul eax, dword [eax + 4], 0x8088405
inc eax
mov edx, dword [0x48ea34]
mov dword [edx + 4], eax
mov eax, dword [0x48ea34]
mov eax, dword [eax + 8]
mov edx, dword [0x48ea34]
mov edx, dword [edx + 4]
shr edx, 0x18
xor eax, edx
and eax, 0xff
mov edx, dword [0x48eb04]
mov eax, dword [edx + eax*4]
mov edx, dword [0x48ea34]
mov edx, dword [edx + 8]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [0x48ea34]
mov dword [edx + 8], eax
pop ecx
pop ebp
ret

Function at 0x478830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x478879
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4788ab
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
call fcn.004787c8
mov edx, dword [ebp - 4]
xor byte [edx], al
mov eax, dword [ebp - 4]
mov dl, byte [eax]
mov al, 1
call fcn.004785d4
inc dword [ebp - 4]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x478856
jmp 0x4788ab
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4788ab
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
call fcn.004787fc
mov edx, dword [ebp - 4]
xor byte [edx], al
mov eax, dword [ebp - 4]
mov dl, byte [eax]
xor eax, eax
call fcn.004785d4
inc dword [ebp - 4]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x47888a
mov esp, ebp
pop ebp
ret
Function at 0x4788b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x478905
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x478943
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 1
call fcn.004787c8
and eax, 0xff
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
mov dl, byte [eax]
mov al, 1
call fcn.004785d4
mov al, byte [ebp - 0x12]
mov edx, dword [ebp - 4]
xor byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4788d6
jmp 0x478943
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x478943
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 1
call fcn.004787fc
and eax, 0xff
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
mov dl, byte [eax]
xor eax, eax
call fcn.004785d4
mov al, byte [ebp - 0x12]
mov edx, dword [ebp - 4]
xor byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x478916
mov esp, ebp
pop ebp
ret

Function at 0x47adec
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x47adfe
add esp, 0xfffffff0
call fcn.00403fcc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x47af05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x34], edx
mov edx, dword [edx]
mov edx, dword [edx + 0x9c]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x3c], edx
mov edx, dword [edx]
mov edx, dword [edx + 0xa0]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x44], edx
mov edx, dword [edx]
mov edx, dword [edx + 0xa4]
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x2c], edx
mov edx, dword [edx]
mov edx, dword [edx + 0xa8]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x610]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x47aeba
mov eax, dword [ebp - 4]
add eax, 0x70
mov edx, 0x47af38
call fcn.00404a74
mov eax, dword [ebp - 4]
add eax, 0x64
mov edx, dword [ebp + 0xc]
call fcn.00404a74
mov eax, dword [ebp - 4]
mov byte [eax + 0x60], 1
jmp 0x47aeda
mov eax, dword [ebp - 4]
add eax, 0x70
mov edx, dword [ebp + 0xc]
call fcn.00404a74
mov eax, dword [ebp - 4]
add eax, 0x64
call fcn.00404a20
mov eax, dword [ebp - 4]
mov byte [eax + 0x60], 0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00403c64
mov eax, dword [ebp - 4]
mov dx, word [ebp + 8]
mov word [eax + 0x6c], dx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af0c
lea eax, [ebp + 0xc]
call fcn.00404a20
ret
Function at 0x484f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x484f4f
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x484f48
mov ecx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404ed0
mov eax, dword [ebp - 8]
call fcn.00404ed0
mov ecx, dword [ebp + 0x10]
inc ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [0x4010c0]
call fcn.00405674
xor eax, eax
push ebp
push 0x4850f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi], 1
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.004079ec
lea eax, [ebp - 0x70]
mov edx, 0x10
call fcn.004079ec
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov ax, word [ebp + 0xc]
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404ab8
mov eax, dword [ebp - 4]
call fcn.00404ce0
test eax, eax
jle 0x484ff4
push 0x485118
push dword [ebp - 4]
push 0x485118
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404da0
mov esi, dword [ebp + 0x10]
test esi, esi
jl 0x48503f
inc esi
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
call fcn.00404ce0
test eax, eax
jle 0x485039
mov eax, dword [ebp - 0x10]
call fcn.00404ce0
test eax, eax
jle 0x48502f
push dword [ebp - 0x10]
push 0x485124
push dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404da0
jmp 0x485039
lea eax, [ebp - 0x10]
mov edx, dword [ebx]
call fcn.00404ab8
add ebx, 4
dec esi
jne 0x484fff
mov eax, dword [ebp - 8]
call fcn.00404ce0
test eax, eax
jle 0x485058
mov eax, dword [ebp - 8]
call fcn.00404ee0
mov dword [ebp - 0x1c], eax
jmp 0x48505d
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
call fcn.00404ce0
test eax, eax
jle 0x485076
mov eax, dword [ebp - 0x14]
call fcn.00404ee0
mov dword [ebp - 0x18], eax
jmp 0x48507b
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404ee0
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4850af
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
jmp 0x4850bb
mov ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850fc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404a44
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
inc ecx
mov edx, dword [0x4010c0]
call fcn.00405534
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a44
ret
Function at 0x100071c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100111f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x24]
push ebp
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], ebx
call fcn.1000ada0
mov eax, dword [ebx + 8]
xor ebp, ebp
push eax
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [ebx + 0x24], eax
call fcn.1000b3b0
cmp eax, ebp
mov dword [ebx + 0x38], eax
je 0x1000724b
push esi
lea edx, [eax*4]
push edi
push edx
call sub.MFC42.DLL_operatornew
mov ecx, dword [ebx + 0x38]
mov esi, dword [ebx + 4]
shl ecx, 2
mov dword [ebx + 0x2c], eax
mov edi, eax
mov eax, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x1000724e
mov dword [ebx + 0x2c], ebp
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x30], ebp
mov dword [ebx + 0x34], ebp
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x1000f2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100113a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
mov ebp, ecx
push esi
lea eax, [esp + 0xc]
push edi
lea esi, [ebp + 4]
push eax
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.1000b500
mov edi, dword [eax]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.1000b500
mov ebx, dword [eax + 4]
xor esi, esi
push 0xffffff
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
call sub.MFC42.DLL_CBrush::CBrush
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
neg eax
sbb eax, eax
and eax, edx
lea edx, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x50]
push edx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [ebp + 0x24]
cmp ebx, esi
mov dword [esp + 0x10], edx
jle 0x1000f3c2
mov ebp, ebx
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x1000f38c
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 0xcc0020
push 0
push ecx
mov ecx, dword [edx]
push ecx
push 1
push edi
push ebp
push 0
push 1
push edi
push esi
push 0
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
dec ebp
cmp esi, ebx
jl 0x1000f381
xor esi, esi
mov dword [esp + 0x1c], 0x10013b94
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], esi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x1000f530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100113f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esp + 0x28]
lea edi, [esi + 4]
push eax
mov ecx, edi
mov dword [esp + 0x20], edi
call fcn.1000b500
mov ebx, dword [eax]
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.1000b500
mov ebp, dword [eax + 4]
xor edi, edi
push edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
call sub.MFC42.DLL_CBrush::CBrush
lea eax, [esp + 0x30]
mov dword [esp + 0x50], edi
mov edi, dword [esp + 0x34]
lea edx, [esp + 0x38]
neg eax
sbb eax, eax
and eax, edi
push eax
mov eax, dword [esp + 0x5c]
push edx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x24]
imul eax, dword [esi + 0xc]
mov dword [esp + 0x28], edx
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 3
cdq
and edx, 3
add eax, edx
mov esi, eax
sar esi, 2
shl esi, 2
mov edi, esi
imul edi, ebp
push edi
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esp + 0x14], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
test ebp, ebp
jle 0x1000f660
xor ebx, ebx
mov dword [esp + 0x14], ebp
xor ecx, ecx
test esi, esi
jle 0x1000f64f
mov edx, dword [esp + 0x1c]
lea ebp, [ebx + ecx]
xor eax, eax
mov edx, dword [edx]
mov al, byte [edx + ebp]
imul eax, edi
cdq
and edx, 0xff
add eax, edx
mov edx, dword [esp + 0x10]
sar eax, 8
lea ebp, [ebx + edx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebp - 1], al
jl 0x1000f61e
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add ebx, esi
dec eax
mov dword [esp + 0x14], eax
jne 0x1000f618
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x58]
test eax, eax
je 0x1000f66b
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
push 0xcc0020
push 0
push ecx
push edx
push ebp
push ebx
push 0
push 0
push ebp
push ebx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x100
jl 0x1000f60e
mov eax, dword [esp + 0x10]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0x30], 0x10013b94
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x411052
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0x208], ecx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0x100
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x41112d
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call fcn.00411052
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
jmp 0x411135
cmp esi, 0x80070103
je 0x411140
test esi, esi
jne 0x411142
xor ecx, ecx
jmp 0x411072
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x411157
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411786
mov esp, ebp
pop ebp
ret 4

Function at 0x41116b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x411195
xor esi, esi
inc esi
jmp 0x4111dc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call fcn.00411052
mov esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x4111eb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x408927
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
call fcn.00408943
xor dword [ebx], ecx
inc ebx
sub esp, 4
mov dword [esp], eax
pop eax
cmp ebx, edi
jne fcn.00408927
sub edx, eax
ret