joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b260
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.00409ed0
test eax, eax
jne 0x40b278
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x20006
xor esi, esi
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.00401ac0
cmp eax, esi
je 0x40b2c1
push eax
call fcn.00401760
mov edi, eax
mov eax, dword [ebp - 0x10]
add esp, 4
cmp eax, esi
je 0x40b2b9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x10]
push 0x20006
push str.29423E88_D05F_477B_A0C2_E7BB802FEB54
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00401ac0
cmp eax, esi
je 0x40b312
push eax
call fcn.00401760
mov edi, eax
mov eax, dword [ebp - 0x1c]
add esp, 4
cmp eax, esi
je 0x40b2fe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x40b309
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1c]
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [0x4406a4]
lea eax, [ebp - 0x20]
push eax
push esi
push 0x65
push ecx
mov dword [ebp - 0x20], str.APPID
mov dword [ebp - 0x1c], str.29423E88_D05F_477B_A0C2_E7BB802FEB54
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00406d70
mov dword [ebp - 4], eax
cmp edi, esi
je 0x40b356
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x40b361
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410830
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42be4f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43f838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00401110
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [ebp - 4], 0
call fcn.00401110
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov byte [ebp - 4], 1
call fcn.00401110
add eax, 0x10
mov dword [esi + 8], eax
movzx eax, byte [edi + 0xc]
mov byte [esi + 0xc], al
movzx ecx, byte [edi + 0xd]
mov byte [esi + 0xd], cl
movzx edx, byte [edi + 0xe]
mov byte [esi + 0xe], dl
movzx eax, byte [edi + 0xf]
mov byte [esi + 0xf], al
movzx ecx, byte [edi + 0x10]
mov byte [esi + 0x10], cl
movzx edx, byte [edi + 0x11]
mov byte [esi + 0x11], dl
movzx eax, byte [edi + 0x12]
mov byte [esi + 0x12], al
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
movzx eax, byte [edi + 0x1c]
mov byte [esi + 0x1c], al
movzx ecx, byte [edi + 0x1d]
mov byte [esi + 0x1d], cl
movzx edx, byte [edi + 0x1e]
mov byte [esi + 0x1e], dl
movzx eax, byte [edi + 0x1f]
mov byte [esi + 0x1f], al
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
movzx edx, byte [edi + 0x24]
mov byte [esi + 0x24], dl
mov eax, dword [edi + 0x28]
sub eax, 0x10
push eax
mov byte [ebp - 4], 2
call fcn.00401110
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
sub eax, 0x10
push eax
mov byte [ebp - 4], 3
call fcn.00401110
add eax, 0x10
mov dword [esi + 0x2c], eax
movzx eax, byte [edi + 0x30]
mov byte [esi + 0x30], al
movzx ecx, byte [edi + 0x31]
mov byte [esi + 0x31], cl
mov eax, dword [edi + 0x34]
sub eax, 0x10
push eax
mov byte [ebp - 4], 4
call fcn.00401110
add eax, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
sub eax, 0x10
push eax
mov byte [ebp - 4], 5
call fcn.00401110
add esp, 0x1c
add eax, 0x10
mov dword [esi + 0x38], eax
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
movzx eax, byte [edi + 0x40]
mov byte [esi + 0x40], al
movzx ecx, byte [edi + 0x41]
mov byte [esi + 0x41], cl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4195d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x419681
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x419681
mov edx, dword [ebp + 0x10]
push esi
lea ecx, [ebp - 4]
push ecx
push edi
push edx
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x419671
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.0041edef
mov edi, eax
add esp, 4
test edi, edi
je 0x41966c
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push esi
push edi
call fcn.0041ee00
add esp, 0xc
cmp dword [ebp - 4], esi
jbe 0x419671
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push edi
push eax
push esi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x419671
push edi
call fcn.0041ec8b
mov edx, dword [ebp - 8]
add esp, 4
xor edi, edi
mov dword [edx], esi
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, 0xe
mov edx, dword [ebp - 8]
mov dword [edx], esi
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov dword [ecx], 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x419830
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cfa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43f838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 4], ebx
je 0x419878
push 0x439bb4
lea eax, [ebp - 0x11]
push eax
mov byte [ebp - 0x11], bl
call fcn.0041e525
mov eax, dword [esi + 8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x41989c
push 0x439bb4
lea ecx, [ebp - 0x12]
push ecx
mov byte [ebp - 0x12], bl
call fcn.0041e525
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4198e2
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
push 0x439bb4
lea ecx, [ebp - 0x13]
push ecx
mov byte [ebp - 0x13], bl
call fcn.0041e525
mov byte [ebp - 0x14], 0
mov eax, 0x4198cd
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419900
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 4], 0
jne 0x41991d
mov eax, dword [esi + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41995e
mov ecx, dword [esi + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push eax
call edi
test eax, eax
je 0x419958
cmp eax, 0x80
jne 0x419949
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
test eax, eax
je 0x419952
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
pop edi
pop esi
mov al, bl
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret
pop esi
mov al, bl
pop ebx
ret

Function at 0x419ba0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d039
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43f838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov dword [ebp - 4], edi
call edx
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edx, dword [ebp + 0xc]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x201
or eax, ecx
mov dword [ebp - 4], edi
mov edi, dword [edx]
jge 0x419c0f
push 0x201
mov ecx, esi
call fcn.004011f0
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [0x440c4c]
push edi
push 0x200
push eax
push 0x431b74
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
cmp dword [eax - 8], 0x201
jl 0x419c62
mov dword [eax - 0xc], 0x201
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x402], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.00401000
int3
Function at 0x419ee0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d141
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43f838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov dword [ebp - 4], esi
call edx
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov ebx, dword [ebp + 0x10]
mov eax, 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov esi, 0x2710
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041edef
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x419f78
mov byte [ebp - 0x11], al
push 0x439bb4
lea eax, [ebp - 0x11]
push eax
call fcn.0041e525
mov ecx, dword [ebp + 0xc]
mov dword [edi], 0
mov eax, dword [ecx]
mov ecx, dword [ebx]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
lea edx, [esi - 2]
cmp eax, edx
je 0x41a04d
mov ecx, dword [ebp - 0x20]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.00419c70
mov edx, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [edx]
lea ecx, [eax - 0x10]
sub esi, 0x10
mov byte [ebp - 4], 2
cmp ecx, esi
je 0x41a008
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x419ffb
mov edx, dword [ecx]
cmp edx, dword [esi]
jne 0x419ffb
push ecx
call fcn.00401110
mov dword [ebp + 0x10], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x419fee
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x41a008
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00401250
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a02b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp dword [edx - 0xc], 0
sete al
cmp al, 1
jne 0x41a07e
push 0x439bb4
lea eax, [ebp - 0x12]
push eax
mov byte [ebp - 0x12], 0
call fcn.0041e525
push edi
call fcn.0041ec8b
add esp, 4
mov dword [ebp - 0x18], 0
add esi, 0x3e8
jmp 0x419f43
test edi, edi
je 0x41a08b
push edi
call fcn.0041ec8b
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41aa60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d221
mov eax, dword fs:[0]
push eax
sub esp, 0x920
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push ecx
push edx
lea ecx, [esi + 4]
call fcn.0041b3c0
cmp byte [esi + 0x10], 0
je 0x41ac7f
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
call edx
add eax, 0x10
mov dword [ebp - 0x928], eax
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push ecx
lea edx, [ebp - 0x890]
push 0x3ff
push edx
mov dword [ebp - 4], 0
call fcn.0041fef4
add esp, 0x10
test eax, eax
js 0x41ab02
cmp eax, 0x3ff
ja 0x41ab02
jne 0x41ab0b
xor eax, eax
mov word [ebp - 0x92], ax
jmp 0x41ab0b
xor ecx, ecx
mov word [ebp - 0x92], cx
lea eax, [ebp - 0x890]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ab14
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x890]
push edx
lea ecx, [ebp - 0x928]
call fcn.00401250
mov ecx, dword [ebp - 0x928]
push 3
lea eax, [ebp - 0x920]
push ecx
lea ecx, [ebp - 0x924]
mov dword [ebp - 0x924], eax
call fcn.0041a400
mov eax, dword [ebp - 0x924]
mov byte [ebp - 4], 1
test eax, eax
je 0x41ac43
mov edx, SysReAllocString
mov ecx, eax
nop
cmp byte [ecx], 0
je 0x41ab7e
inc ecx
dec edx
jne 0x41ab70
jmp 0x41ac43
test edx, edx
je 0x41ac43
push eax
lea ecx, [ebp - 0x92c]
call fcn.0041a850
lea edx, [ebp - 0x8a0]
push edx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x80
lea eax, [ebp - 0x90]
push eax
push 0
lea ecx, [ebp - 0x8a0]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub esp, 0x84
mov edi, esp
push eax
push ebx
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x92c]
push str._s_:__0x_X_0x_X___s
mov ecx, 0x21
lea esi, [ebp - 0x924]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0041a830
mov ecx, dword [ebp - 0x92c]
add esp, 0x98
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x92c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ac3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x924]
lea ecx, [ebp - 0x920]
cmp eax, ecx
je 0x41ac56
push eax
call fcn.0041eaa9
add esp, 4
mov eax, dword [ebp - 0x928]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ac7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
Function at 0x41ae20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x41ae98
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test ebx, ebx
je 0x41ae94
test eax, eax
je 0x41ae94
push str.DebugOpen
push eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push str.DebugClose
push eax
call edi
mov ecx, dword [esi + 4]
push str.TraceWrite
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 4]
push str.DumpWrite
push edx
mov dword [esi + 0x14], eax
call edi
cmp dword [esi + 0xc], 0
mov dword [esi + 0x18], eax
je 0x41ae94
cmp dword [esi + 0x10], 0
je 0x41ae94
cmp dword [esi + 0x14], 0
je 0x41ae94
test eax, eax
jne 0x41ae98
xor ebx, ebx
jmp 0x41ae9d
mov ebx, 1
cmp dword [esi + 8], 0
jne 0x41af03
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 8], eax
test eax, eax
je 0x41aeff
push str.DebugOpen
push eax
call edi
mov ecx, dword [esi + 8]
push str.DebugClose
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 8]
push str.TraceWrite
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 8]
push str.DumpWrite
push eax
call edi
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x28], eax
je 0x41aeff
cmp dword [esi + 0x20], 0
je 0x41aeff
cmp dword [esi + 0x24], 0
je 0x41aeff
test eax, eax
jne 0x41af03
xor eax, eax
jmp 0x41af08
mov eax, 1
test ebx, ebx
je 0x41af0e
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push esi
lea edx, [ebp - 4]
push edx
push 0x20019
xor esi, esi
lea ecx, [eax + eax]
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41b0bd
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41b0d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x41b19f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
je 0x41b198
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenA
push eax
call edi
mov ecx, dword [esi + 4]
push str.CloseA
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 4]
push str.TraceWriteA
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
push str.DumpWriteA
push eax
call edi
mov ecx, dword [esi + 4]
push str.OpenW
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 4]
push str.CloseW
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
push str.TraceWriteW
push eax
call edi
mov ecx, dword [esi + 4]
push str.DumpWriteW
push ecx
mov dword [esi + 0x20], eax
call edi
cmp dword [esi + 8], 0
mov dword [esi + 0x24], eax
pop edi
je 0x41b198
cmp dword [esi + 0xc], 0
je 0x41b198
cmp dword [esi + 0x10], 0
je 0x41b198
cmp dword [esi + 0x14], 0
je 0x41b198
cmp dword [esi + 0x18], 0
je 0x41b198
cmp dword [esi + 0x1c], 0
je 0x41b198
cmp dword [esi + 0x20], 0
je 0x41b198
test eax, eax
jne 0x41b19f
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x41bf20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
xor eax, eax
test ecx, ecx
je 0x41bfec
cmp dword [ecx + 4], eax
setne al
test eax, eax
jne 0x41bfec
mov ecx, 0x208
lea eax, [ebp - 0x20c]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x41bf60
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.BrLogAPI
push str.SoftwareBrotherBrUtilities
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b060
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov esi, eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test esi, esi
pop esi
jne 0x41bfb3
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41bfdd
mov ecx, 0x208
lea eax, [ebp - 0x20c]
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x41bfc0
push 0x4352ac
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0041b4b0
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [edi + 4]
call fcn.0041b0d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret

Function at 0x41e9a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f838]
jne 0x41e9b0
repz ret
jmp fcn.0042202c
Function at 0x42818c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00421a20
and dword [ebp - 0x14], 0
cmp dword [0x441a64], 0
mov dword [ebp - 0x18], eax
jne 0x42823f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4282e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x436ea4
push ebx
call edi
test eax, eax
je 0x4282e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x441a64], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x441a68], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x441a6c], eax
call edi
push eax
call esi
mov dword [0x441a74], eax
test eax, eax
je 0x42823f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x441a70], eax
mov eax, dword [0x441a70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x428298
cmp dword [0x441a74], ecx
je 0x428298
push eax
call esi
push dword [0x441a74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x428298
test ebx, ebx
je 0x428298
call edi
test eax, eax
je 0x42828f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42828f
test byte [ebp - 8], 1
jne 0x428298
or dword [ebp + 0x10], 0x200000
jmp 0x4282cb
mov eax, dword [0x441a68]
cmp eax, dword [ebp - 0x18]
je 0x4282cb
push eax
call esi
test eax, eax
je 0x4282cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4282cb
mov eax, dword [0x441a6c]
cmp eax, dword [ebp - 0x18]
je 0x4282cb
push eax
call esi
test eax, eax
je 0x4282cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x441a64]
call esi
test eax, eax
je 0x4282e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4282e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e9a6
leave
ret

Function at 0x449bfa
Capabilities:
Encode data using xor

Disassembly:
ret
call esi
cld
push eax
jmp 0x449c41
pop edi
call esi
xor edx, ebx
lea ecx, [edi - 0x47290a70]
mov cl, ch
inc dh
lea ecx, [edi - 0x49]
cmp eax, edi
not dh
lea ecx, [ebx]
je 0x449c42
jmp 0x449d69
or ecx, 0xffffffe1
sbb cl, 0x8f
push eax
rdtsc
pop ecx
jmp 0x449a11
Function at 0x449c13
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
wait
wait
cld
cld
je 0x449c0b
and eax, 0
imul eax, eax, 0xf
nop
xchg esp, esp
xchg esp, esp
push eax
dec bh
inc bh
movzx eax, byte [edi]
jmp 0x449b72
not ah
not ah
inc edi
inc cl
dec cl
dec eax
inc eax
cmc
sub dword [esp], eax
wait
cmp byte [edi], 0
pop eax
ja 0x449a5a
jmp 0x44e8c1
sbb edi, 0xddb1a7f5
not edi
cmc
xchg ch, ah
xchg ch, ah
inc ecx
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
jmp 0x449a4c
dec edx
cmp edx, 0xff5e0f34
mov edx, 0x921ba40c
sahf
pop esi
add esi, dword [edi + eax*4]
ret 4
ret
mov edx, ebx
sbb ch, 0xa4
mov esi, ebx
cld
not edi
adc ecx, 0x52
dec ah
mov eax, edx
cmp ah, 0x9a
sub ah, 0x7f
xchg ch, cl
add ecx, 0xe4cea230
mov eax, ebx
mov edi, 0x439e21ad
add eax, dword [ebx + 0x3c]
jmp 0x449ccc
add edx, dword [eax + 0x78]
add esi, dword [edx + 0x20]
or ecx, 0xffffffff
xchg edi, edi
test bl, 0xc1
add edi, 0xfffffff9
xchg al, bl
xchg al, bl
lodsd eax, dword [esi]
jmp 0x449b91
add edi, dword [edx + 0x1c]
or ah, al
add esi, dword [edx + 0x24]
not edx
wait
lea esi, [esi + ecx*2]
push ebx
adc edx, 0xa369226d
movzx eax, word [esi]
jmp 0x449be6
wait
lea edi, [edi]
nop
nop
xor eax, 0x35e8b920
mov ebx, ebx
cld
xchg edi, ebp
xchg edi, ebp
lea eax, [eax]
lea edx, [edx]
mov edx, edx
lea ecx, [ecx]
xchg dh, cl
xchg dh, cl
sub eax, dword [esp + 4]
jne 0x449ce1
mov al, 0x38
xchg al, ah
test al, cl
cwde
mov edi, ebx
lea eax, [ecx - 0xa]
sub ah, 0xcb
add al, bl
sbb ah, 0x61
mov esi, ebx
jmp 0x449d09
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219