joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb021b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b02140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b02140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b02140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b02140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb02bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb02c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb1487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb02c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb02c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x420a365d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x6d8240aa
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4082c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x43a090], eax
mov edx, 1
dec edx
nop
inc edx
mov eax, edx
dec eax
mov ecx, dword [eax*4 + 0x43a090]
shr ecx, 0x1e
mov eax, edx
dec eax
mov eax, dword [eax*4 + 0x43a090]
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x43a090], ecx
cmp edx, 0x26f
jl 0x4082cc
mov dword [0x430950], 0x270
ret

Function at 0x408310
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], esi
mov eax, dword [0x439150]
cmp eax, dword [0x4308e0]
je 0x408331
mov dword [0x430950], 0x271
mov eax, dword [0x430950]
cmp eax, 0x270
jl 0x408459
mov eax, dword [0x430950]
cmp eax, 0x271
jne 0x408368
mov eax, dword [0x439150]
call fcn.004082c0
mov eax, dword [0x439150]
not eax
mov dword [0x439150], eax
mov dword [0x4308e0], eax
mov edx, 0
dec edx
mov esi, esi
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x43a090]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x43a090]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0x18d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x43a090]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x430960]
xor esi, eax
mov dword [edx*4 + 0x43a090], esi
cmp edx, 0xe2
jl 0x408370
mov edx, 0xe3
dec edx
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x43a090]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x43a090]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0xffffff1d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x43a090]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x430960]
xor esi, eax
mov dword [edx*4 + 0x43a090], esi
cmp edx, 0x26e
jl 0x4083c8
mov eax, dword [0x43aa4c]
and eax, 0x80000000
mov edx, dword [0x43a090]
and edx, 0x7fffffff
or eax, edx
mov ecx, eax
shr eax, 1
mov edx, dword [0x43a6c0]
xor eax, edx
and ecx, 1
mov edx, dword [ecx*4 + 0x430960]
xor eax, edx
mov dword [0x43aa4c], eax
mov dword [0x430950], 0
mov eax, dword [0x430950]
mov edx, dword [eax*4 + 0x43a090]
inc dword [0x430950]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 8
ret
Function at 0x40b8d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], edi
call fcn.00401940
mov dword [ebp - 0x114], 0
mov dword [0x439e80], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040bac0
mov eax, dword [0x439e80]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x110]
inc ecx
lea eax, [ebp - 0x108]
call fcn.004022f0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x430420], eax
mov ebx, dword [0x430420]
jmp 0x40ba71
inc ebx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x20
jb 0x40b970
mov al, byte [ebx]
test al, al
je 0x40ba7b
mov byte [ebp - 0x10c], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x40b9e0
mov al, byte [ebx]
cmp al, 1
jb 0x40b9d9
sub al, 0x20
jbe 0x40b9ac
sub al, 2
je 0x40b9be
jmp 0x40b9d9
mov al, byte [ebp - 0x10c]
test al, al
je 0x40b9e6
inc dword [ebp - 0x110]
jmp 0x40b9df
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x40b9d6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40b9df
inc ebx
jmp 0x40b9df
inc dword [ebp - 0x110]
inc ebx
mov al, byte [ebx]
test al, al
jne 0x40b99c
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x40ba6b
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040bac0
mov byte [ebp - 0x10c], 0
mov ebx, edi
mov eax, dword [0x439e80]
mov edx, dword [ebp - 0x114]
mov esi, dword [eax + edx*4]
jmp 0x40ba62
mov al, byte [ebx]
cmp al, 1
jb 0x40ba5c
sub al, 0x20
jbe 0x40ba30
sub al, 2
je 0x40ba41
jmp 0x40ba5c
mov al, byte [ebp - 0x10c]
test al, al
je 0x40ba68
mov al, byte [ebx]
mov byte [esi], al
inc esi
jmp 0x40ba61
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x40ba59
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40ba61
inc ebx
jmp 0x40ba61
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
mov al, byte [ebx]
test al, al
jne 0x40ba20
mov byte [esi], 0
inc dword [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x40b971
mov ebx, dword [ebp - 0x114]
mov dword [0x439e70], ebx
mov edx, ebx
inc edx
shl edx, 2
mov eax, 0x439e80
call fcn.00409df0
mov eax, dword [0x439e80]
mov dword [eax + ebx*4], 0
mov ebx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x118]
leave
ret
Function at 0x40c970
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], esi
mov ebx, eax
mov esi, edx
mov edx, dword [0x439170]
test edx, edx
je 0x40c99c
mov eax, dword [0x43b430]
call edx
jmp 0x40c9a1
mov eax, 0x43b434
mov word [eax], 0
lea eax, [ebp - 0x44]
mov cl, 0
mov edx, 0x44
call fcn.00402340
mov dword [ebp - 0x44], 0x44
mov word [ebp - 0x14], 1
mov edx, ebx
mov al, 0x22
call fcn.00403240
test eax, eax
jne 0x40ca05
push 2
mov eax, 0x430aa0
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], ebx
mov eax, 0x430aa0
mov dword [ebp - 0x45c], eax
lea ecx, [ebp - 0x464]
lea eax, [ebp - 0x458]
mov edx, 0xff
call fcn.004029d0
jmp 0x40ca17
mov ecx, ebx
lea eax, [ebp - 0x458]
mov edx, 0xff
call fcn.00402500
movzx ecx, byte [ebp - 0x458]
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x457]
call fcn.004022f0
mov byte [ebp - 0x358], 0x20
mov byte [ebp - 0x357], 0x20
movzx ecx, byte [esi]
lea edx, [ebp - 0x356]
lea eax, [esi + 1]
call fcn.004022f0
movzx eax, byte [esi]
add eax, 2
mov byte [ebp + eax - 0x358], 0
lea eax, [ebp - 0x358]
call fcn.00402610
mov ecx, eax
inc ecx
movzx eax, byte [ebp - 0x458]
lea edx, [ebp + eax - 0x258]
lea eax, [ebp - 0x358]
call fcn.004022f0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push dword [0x430ad0]
push 0
push 0
lea eax, [ebp - 0x258]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40cad7
call sub.kernel32.dll_GetLastError
call fcn.0040c950
mov bx, ax
mov edx, dword [0x439170]
test edx, edx
je 0x40cacd
mov eax, dword [0x43b430]
call edx
jmp 0x40cad2
mov eax, 0x43b434
mov word [eax], bx
jmp 0x40cb28
push 0xffffffffffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
je 0x40caf4
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x40cafb
mov dword [ebp - 0x58], 0xffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
mov edx, dword [0x439170]
test edx, edx
je 0x40cb1e
mov eax, dword [0x43b440]
call edx
jmp 0x40cb23
mov eax, 0x43b444
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov ebx, dword [ebp - 0x46c]
mov esi, dword [ebp - 0x468]
leave
ret
Function at 0x4210a0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push esi
push edi
mov eax, ebx
mov edx, 0
call fcn.00421020
cmp edx, esi
jne 0x4210da
cmp eax, edi
jne 0x4210da
push ebx
call sub.kernel32.dll_SetEndOfFile
or eax, eax
setne al
jmp 0x4210dc
mov al, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
leave
ret 8

Function at 0x421150
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ebx
mov bl, cl
push 2
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x421171
mov al, byte [ebp - 4]
jmp 0x421173
mov al, bl
mov ebx, dword [ebp - 8]
leave
ret
Function at 0x42d760
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 4]
call fcn.00404d70
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x54]
mov eax, 1
call fcn.00407750
call fcn.00408d00
push eax
test eax, eax
jne 0x42d93c
mov dword [ebp - 0x20], 0
dec dword [ebp - 0x20]
mov esi, esi
inc dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov byte [eax + edx], 0
cmp dword [ebp - 0x20], 0xf
jl 0x42d7ac
mov dword [ebp - 0x20], 0
dec dword [ebp - 0x20]
lea esi, [esi]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov word [ebp + eax*2 - 0x18], 0
cmp dword [ebp - 0x20], 7
jl 0x42d7cc
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
call fcn.00402820
mov dword [ebp - 0x5c], 0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0042d610
mov eax, dword [ebp - 0x5c]
call fcn.00404d70
lea eax, [ebp - 4]
call fcn.00402820
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d81f
jmp 0x42d824
jmp 0x42d93c
jmp 0x42d8d1
mov eax, dword [ebp - 0x1c]
cmp eax, 7
jg 0x42d836
jmp 0x42d83b
jmp 0x42d93c
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x438600
call fcn.0042ca70
mov eax, dword [ebp - 0x2c]
mov edx, 0x43863c
call fcn.00405170
test eax, eax
je 0x42d85e
jmp 0x42d863
jmp 0x42d8de
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x42d86c
jmp 0x42d878
mov eax, dword [ebp - 0x1c]
mov word [ebp + eax*2 - 0x18], 0
jmp 0x42d8ce
lea eax, [ebp - 0x5c]
call fcn.00402820
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x5c]
mov edx, 0x438618
call fcn.00404da0
mov eax, dword [ebp - 0x5c]
mov edx, 0xffffffff
call fcn.0041d970
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xffff
jg 0x42d8bd
jmp 0x42d8b3
mov eax, dword [ebp - 0x30]
cmp eax, 0
jl 0x42d8bd
jmp 0x42d8c2
jmp 0x42d93c
mov edx, dword [ebp - 0x1c]
mov ax, word [ebp - 0x30]
mov word [ebp + edx*2 - 0x18], ax
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x42d82c
jmp 0x42d8de
mov dword [ebp - 0x20], 0
dec dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
movzx eax, word [ebp + eax*2 - 0x18]
mov edx, eax
sar edx, 0x1f
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x20]
movzx eax, word [ebp + eax*2 - 0x18]
cdq
mov ecx, 0x100
idiv ecx
mov byte [ebp - 0x28], dl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov cl, byte [ebp - 0x24]
mov byte [edx + eax], cl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
inc eax
mov cl, byte [ebp - 0x28]
mov byte [edx + eax], cl
cmp dword [ebp - 0x20], 7
jl 0x42d8e8
call fcn.00407a10
lea eax, [ebp - 0x5c]
call fcn.00402820
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x2c]
call fcn.00402820
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 4]
call fcn.00402820
pop eax
test eax, eax
je 0x42d971
call fcn.00407b70
leave
ret
Function at 0x405aa2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x480084]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.00405d12
mov ebx, eax
cmp ebx, esi
je 0x405b04
cmp dword [esp + 0x10], esi
je 0x405b00
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x405b7a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x405b22
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00405aa2
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x405b91
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x405b0c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
je 0x405b5d
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00405a34
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x405b78
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00412716
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x405ba1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x405b7a
Function at 0x408bff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x45d94d
call fcn.0045716f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x408c57
call fcn.004079c6
mov esi, eax
jmp 0x408d61
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x408c70
call fcn.004079c6
jmp 0x408d53
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x408c66
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x408cad
mov esi, 0x8007000e
jmp 0x408d55
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x408cc2
cmp eax, 0xffffffff
jbe 0x408ccc
push 0x80070216
call fcn.0040633e
cmp eax, 0x400
jbe 0x408cf9
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00407e5a
jmp 0x408d05
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x408ca3
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x408c66
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.00408a9f
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x408d7a
lea eax, [ebp - 0x418]
call fcn.00407e3c
mov eax, esi
call fcn.004571cb
ret 0xc
Function at 0x40c796
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c7fa
cmp dword [ebp + 0xc], 1
je 0x40c7d2
cmp dword [ebp + 0xc], 2
je 0x40c7d2
push 0xd
pop eax
jmp 0x40c7fa
mov eax, dword [ebp - 4]
test edi, edi
je 0x40c7f4
test eax, eax
je 0x40c7ef
test al, 1
jne 0x40c7cd
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40c7f4
jmp 0x40c7cd
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x4123e9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4820e0], 0
push esi
push edi
jne 0x41235f
call fcn.004122cb
test eax, eax
je 0x4123a4
mov eax, dword [0x4820e0]
cmp eax, 1
jne 0x412380
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4123a4
jmp 0x4123e6
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4123e6
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4123a8
xor eax, eax
jmp 0x4123e6
mov eax, dword [esi]
push dword [0x4820e0]
call edi
mov edi, eax
test edi, edi
je 0x4123ca
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4123e6
lea edi, [esi + 0xff0]
push esi
push dword [0x4820e0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4123d0
mov eax, esi
pop edi
pop esi
ret
jmp 0x41234b

Function at 0x412716
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x480084]
jne 0x412720
repz ret
jmp fcn.004159b2
Function at 0x4200bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x480084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418b4d
and dword [ebp - 0x14], 0
cmp dword [0x482f24], 0
mov dword [ebp - 0x18], eax
jne 0x42016e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x420216
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x420216
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x482f24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x482f28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x482f2c], eax
call edi
push eax
call esi
mov dword [0x482f34], eax
test eax, eax
je 0x42016e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x482f30], eax
mov eax, dword [0x482f30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4201c7
cmp dword [0x482f34], ecx
je 0x4201c7
push eax
call esi
push dword [0x482f34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4201c7
test ebx, ebx
je 0x4201c7
call edi
test eax, eax
je 0x4201be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4201be
test byte [ebp - 8], 1
jne 0x4201c7
or dword [ebp + 0x10], 0x200000
jmp 0x4201fa
mov eax, dword [0x482f28]
cmp eax, dword [ebp - 0x18]
je 0x4201fa
push eax
call esi
test eax, eax
je 0x4201fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4201fa
mov eax, dword [0x482f2c]
cmp eax, dword [ebp - 0x18]
je 0x4201fa
push eax
call esi
test eax, eax
je 0x4201fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x482f24]
call esi
test eax, eax
je 0x420216
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x420218
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412716
leave
ret
Function at 0x4419a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 8

Function at 0x441a9c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
fld qword [0x47a968]
push 1
fstp qword [esp + 4]
push dword [ebp + 0xc]
fld qword [esp + 8]
fadd qword [0x47a960]
push dword [ebp + 8]
fadd qword [esp + 0xc]
fsub qword [esp + 0xc]
fsub qword [0x47a958]
fadd qword [esp + 0xc]
fadd qword [0x47a950]
fld qword [esp + 0xc]
fmul qword [esp + 0xc]
fsubp st(1)
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fld qword [esp + 0xc]
fmul qword [0x47a8f8]
fsubp st(1)
fld qword [esp + 0xc]
fmul qword [0x47a948]
fsubp st(1)
fadd qword [esp + 0xc]
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fsub qword [esp + 0xc]
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fmul qword [0x47a940]
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fmul qword [esp + 0xc]
fsub qword [esp + 0xc]
fadd qword [0x47a938]
fadd qword [esp + 0xc]
fsub qword [0x47a930]
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fsub qword [esp + 0xc]
fld qword [esp + 0xc]
fmul qword [esp + 0xc]
fsubp st(1)
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
fld qword [esp + 0xc]
fmul qword [esp + 0xc]
fsubp st(1)
fld qword [esp + 0xc]
fdiv qword [0x47a928]
faddp st(1)
fsub qword [esp + 0xc]
fadd qword [esp + 0xc]
fsub qword [0x47a920]
fsub qword [esp + 0xc]
fstp qword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x441be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], 0x2f
mov dword [ebp - 0xc], 0x29
mov dword [ebp - 8], 0x37
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x1c], 0x50
mov dword [ebp - 0x10], 0x5d
mov dword [ebp - 0x14], 9
mov eax, dword [ebp - 0xc]
sub eax, 0x11
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
imul eax, eax, 0x7ec
imul ecx, ecx, 0xffffffee
sub ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
imul eax, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x14]
lea eax, [ecx + eax + 0x3f]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jne 0x441ca3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x441ca3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
imul eax, ecx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
add eax, 0x30
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
imul eax, ecx
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0xf
sub ecx, eax
sub ecx, 0x60
mov dword [ebp - 8], ecx
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret 0xc