joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452cdc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452e87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x452e68
mov dl, 1
mov eax, dword [0x412128]
call fcn.00403304
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404108
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x452e57
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440ccc
test al, al
je 0x452e4a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452e98
lea eax, [ebp - 0x254]
call fcn.00408e98
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x452e4a
xor eax, eax
push ebp
push 0x452e43
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452ed0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x452e2c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404378
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x452e2c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e4a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x452d4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041641c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e8e
lea eax, [ebp - 0x260]
call fcn.00404108
ret

Function at 0x4537bc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47abb4]
cmp byte [eax + 0xa5], 0
jne 0x45382d
cmp dword [0x47abcc], 0
jne 0x4537ee
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x453778
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47abcc], eax
cmp dword [0x47abc8], 0
jne 0x453809
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47abc8], eax
cmp dword [0x47abd0], 0
jne 0x45382d
push esp
push 0
push 0
push 0x45371c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x47abd0], eax
pop edx
ret
Function at 0x453924
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45393b
add esp, 0xfffffff0
call fcn.00403658
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a760
mov eax, dword [0x478fd4]
cmp word [eax + 2], 0
jne 0x453963
mov eax, dword [0x478fd4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004550a4
mov eax, dword [0x4790e4]
cmp word [eax + 2], 0
jne 0x45397d
mov eax, dword [0x4790e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045529c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411c54]
call fcn.00403304
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411c54]
call fcn.00403304
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d2bc]
call fcn.00424a64
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453b04
mov eax, dword [0x478e90]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424e34
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45583c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x478e90]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c694
test eax, eax
je 0x453a72
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040888c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c6bc
test eax, eax
je 0x453a86
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404378
mov eax, dword [0x478cd0]
cmp byte [eax], 0
jne 0x453aba
mov eax, ebx
call fcn.00453c2c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455a18
mov eax, ebx
call fcn.004563dc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453afa
call fcn.004036b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453eac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47abb4]
cmp dword [eax + 0x30], 0
je 0x453f56
cmp dword [ebx + 0x94], 0
jne 0x453f50
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453e3c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x453f50
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453f16
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x453f50
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414230
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453f25
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454ab8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454aed
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041f8
jmp 0x454afa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040415c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455bf4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455c35
mov eax, esi
call fcn.0043c348
test al, al
je 0x455c35
mov eax, dword [ebx + 0x84]
call fcn.0043c044
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455c35
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c044
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4636ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46371a
mov eax, ebx
call fcn.004641a0
cmp dword [ebx + 0x40], 0
je 0x463713
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46378b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46377d
cmp dword [ebx + 8], 0
je 0x46373c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46374e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46377d
cmp dword [ebx + 8], 0
je 0x46372f
cmp eax, 3
je 0x463761
dec eax
jne 0x46372f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46372f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46372f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4637a9
cmp dword [ebx + 0x14], 0xcc
je 0x4637a9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004637b4
pop ebx
ret
Function at 0x474c44
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x474d42
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x474d25
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x474cf3
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x42b5fc]
call fcn.0042b6fc
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0042b79c
xor ecx, ecx
mov edx, 0x474d58
mov eax, dword [ebp - 4]
call fcn.0042b804
test al, al
je 0x474ce9
push 0x474d94
push dword [ebx + 4]
push 0x474db0
push 0x474dd0
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404488
mov ecx, dword [ebp - 8]
mov edx, 0x474ddc
mov eax, dword [ebp - 4]
call fcn.0042bba0
mov eax, dword [ebp - 4]
call fcn.0042b76c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474d09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474d2c
cmp dword [ebp - 4], 0
je 0x474d24
mov eax, dword [ebp - 4]
call fcn.00403334
ret

Function at 0x474efc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x474fe6
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x474fa6
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x42b5fc]
call fcn.0042b6fc
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x42b5fc]
call fcn.0042b6fc
mov dword [ebp - 8], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0042b79c
mov edx, 0x474ffc
mov eax, dword [ebp - 4]
call fcn.0042be24
test al, al
je 0x474f74
mov edx, 0x474ffc
mov eax, dword [ebp - 4]
call fcn.0042b928
xor ecx, ecx
mov edx, 0x475024
mov eax, dword [ebp - 8]
call fcn.0042b804
test al, al
je 0x474f9c
mov edx, 0x47505c
mov eax, dword [ebp - 8]
call fcn.0042baa0
mov eax, dword [ebp - 8]
call fcn.0042b76c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474fed
cmp dword [ebp - 4], 0
je 0x474fd7
mov eax, dword [ebp - 4]
call fcn.00403334
cmp dword [ebp - 8], 0
je 0x474fe5
mov eax, dword [ebp - 8]
call fcn.00403334
ret

Function at 0x475b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004045b8
mov eax, dword [ebp - 8]
call fcn.004045b8
xor eax, eax
push ebp
push 0x475ba0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004045c8
push eax
mov eax, dword [ebp - 4]
call fcn.004045c8
push eax
push 0x475bac
mov eax, ebx
call fcn.0043c044
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475ba7
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040412c
ret
Function at 0x402e35
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x401420
call fcn.00403038
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x402e72
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402e72
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x402e8a
cmp eax, 0x20b
je 0x402e77
mov dword [ebp - 0x1c], ebx
jmp 0x402e9e
cmp dword [ecx + 0x84], 0xe
jbe 0x402e72
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x402e98
cmp dword [ecx + 0x74], 0xe
jbe 0x402e72
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x404204], 0xffffffff
or dword [0x404208], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x404154]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x404150]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40420c], eax
call fcn.0040302e
cmp dword [0x4040b0], ebx
jne 0x402ef9
push fcn.0040302e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00403017
push 0x404010
push 0x40400c
call sub.msvcrt.dll__initterm
mov eax, dword [0x40414c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x404148]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x404008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x402f8f
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x402f63
cmp al, 0x22
jne 0x402f55
cmp byte [esi], 0x22
jne 0x402f6c
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x402f76
cmp al, 0x20
jbe 0x402f68
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x402f9a
movzx eax, word [ebp - 0x50]
jmp 0x402f9d
cmp byte [esi], 0x20
jbe 0x402f6c
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402f8f
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x402fba
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x402fef
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00403073
ret

Function at 0x4015d0
Capabilities:
Encode data using xor

Disassembly:
push 0x407af8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp - 0x28], ah
invalid
Function at 0x401550
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x401703
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop dword [eax]
push 0
call esi
sub byte [edi + ebp], 0x44
push 0
call esi
add byte [edi + ebp], 0xfa
push 0
call esi
xor byte [edi + ebp], 0xc1
push 0
call esi
add byte [edi + ebp], 0x7f
push 0
call esi
add byte [edi + ebp], 0x6f
push 0
call esi
add byte [edi + ebp], 0xe2
push 0
call esi
add byte [edi + ebp], 0x19
push 0
call esi
xor byte [edi + ebp], 2
push 0
call esi
add byte [edi + ebp], 0x34
push 0
call esi
add byte [edi + ebp], 0x8a
push 0
call esi
xor byte [edi + ebp], 0x33
push 0
call esi
add byte [edi + ebp], 0x5c
push 0
call esi
add byte [edi + ebp], 0x8c
push 0
call esi
add byte [edi + ebp], 0x16
push 0
call esi
add byte [edi + ebp], 0x98
push 0
call esi
add byte [edi + ebp], 0x45
push 0
call esi
xor byte [edi + ebp], 0xb5
push 0
call esi
add byte [edi + ebp], 0xb5
push 0
call esi
add byte [edi + ebp], 0x14
push 0
call esi
add byte [edi + ebp], 0xd5
push 0
call esi
add byte [edi + ebp], 0x99
push 0
call esi
add byte [edi + ebp], 0x3f
push 0
call esi
add byte [edi + ebp], 0x91
push 0
call esi
add byte [edi + ebp], 0xe5
push 0
call esi
add byte [edi + ebp], 0x5f
push 0
call esi
xor byte [edi + ebp], 0xd9
push 0
call esi
add byte [edi + ebp], 0x21
push 0
call esi
add byte [edi + ebp], 0x1e
push 0
call esi
add byte [edi + ebp], 0x56
push 0
call esi
add byte [edi + ebp], 0xa8
push 0
call esi
add byte [edi + ebp], 0xe5
push 0
call esi
xor byte [edi + ebp], 0xf
push 0
call esi
xor byte [edi + ebp], 0x30
push 0
call esi
xor byte [edi + ebp], 0x5d
push 0
call esi
add byte [edi + ebp], 0x65
push 0
call esi
add byte [edi + ebp], 0xfd
push 0
call esi
xor byte [edi + ebp], 0xaf
push 0
call esi
add byte [edi + ebp], 0x60
push 0
call esi
add byte [edi + ebp], 0xbf
push 0
call esi
xor byte [edi + ebp], 0x5a
push 0
call esi
add byte [edi + ebp], 0xd0
push 0
call esi
xor byte [edi + ebp], 0xd9
push 0
call esi
add byte [edi + ebp], 0x18
push 0
call esi
xor byte [edi + ebp], 9
push 0
call esi
add byte [edi + ebp], 0x30
push 0
call esi
xor byte [edi + ebp], 0xa6
push 0
call esi
add byte [edi + ebp], 0xcb
push 0
call esi
add byte [edi + ebp], 0x1e
push 0
call esi
add byte [edi + ebp], 0x2c
inc edi
cmp edi, ebx
jb 0x401570
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x4024a2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4024e1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4024e1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4024e1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4024e1
cmp dword [ecx + 0x74], 0xe
jbe 0x4024e1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408a74
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416860
push 0x416858
push str.FlsAlloc
push 0x1e
call fcn.00408935
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408aa8
push dword [ebp + 8]
mov ecx, esi
call dword [0x414124]
call esi
jmp 0x408aae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408af2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416870
push 0x416868
push str.FlsGetValue
push 0x20
call fcn.00408935
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408b29
push dword [ebp + 8]
mov ecx, esi
call dword [0x414124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4138b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4138dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4138dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401330
Capabilities:
Get common file path

Disassembly:
sub esp, 0x28
push ebx
lea ecx, [esp + 8]
push esi
push ecx
xor ebx, ebx
lea eax, [esp + 0xc]
push 0x11
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x403020
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
cmp eax, ebx
je 0x40139a
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
pop esi
pop ebx
add esp, 0x28
ret
mov byte [esi], bl
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x4013b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 8], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsD:GLadGarland.exe
push 0x80000002
mov dword [esp + 0x18], 0x160
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4013ee
mov ecx, dword [esp + 0x10]
mov byte [ecx], 0
add esp, 0xc
ret
mov ecx, dword [esp]
push esi
mov esi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push esi
push eax
push 0
push str.Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401417
mov byte [esi], 0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0xc
ret
Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
push ecx
push eax
push esi
push edx
call fcn.00406fa0
add esp, 0x18
pop edi
sbb dword [ebp - 0x3e], 0x18
arpl word [eax + 0x5590909a], dx
push ebp
push ebp
mov ebp, esp
sahf
xchg ebx, eax
and al, 0xc5
pop ss
insd dword es:[edi], dx
jne 0x406f8a
xor ecx, dword [eax - 0x30]
push edi
mov dword [ebp - 0xc], esi
jne 0x406fba
mov esi, str.0.0.0.0
mov al, byte [esi]
cmp al, 0x30
jl 0x40707d
cmp al, 0x39
add eax, ecx
add byte es:[ebp - 0xbcbc000], dh
pop dword [eax]
push esi
call dword [0x2140c1c2]
xchg esp, eax
ror byte [ebx - 0x4c367c02], 1
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
xchg cl, dl
jne 0x2040707d
push esi
invalid
push es
inc ebp
or al, 0x68
dec eax
or al, 0x39
sbb dword [edi], ecx
or byte [eax - 0x77000000], ch
ret
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
jne 0x407010
cmp al, 0x32
fadd st(1)
sbb byte [eax], al
invalid
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebx, ecx
fld qword [ebp + 0x1c]
mov ecx, dword [ebp + 0x48]
sbb al, 0x55
adc al, 0x59
mov eax, dword [ebp + 0x10]
and byte [ecx], al
push ecx
dec ebp
or al, 0x52
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
push cs
mov byte [eax], al
add byte [ebx - 0x3ca2243c], al
nop
nop
rcl byte [eax - 0x6f976f2a], cl
imul byte [ebp + 0x3a83ec8b]
lodsd eax, dword [esi]
mov ebp, esp
cmp dword [edx], 0x14
invalid
jge 0x407f09
dec edi
jl 0x407f03
mov dword [ebp - 0x1b], 0xc84e
fld qword [ebp - 0x63]
fcomp qword [0x740cf30]
xor bh, cl
inc eax
pop es
iretd
mov ecx, dword [ebp + 1]
push ebx
jg 0x407f33
push esi
xor esi, esi
push edi
fnstsw ax
mov dword [ebp - 0x56], esi
mov dword [ecx], esi
test ah, 5
mov esi, dword [ebx + 0x2dd3c05]
or cl, bl
loopne 0x407f08
stosb byte es:[edi], al
or bh, al
add dword [ecx], eax
add al, bh
add byte [ebx + 0x5540144d], cl
mov ecx, dword [ebp + 0x14]
inc eax
push ebp
or dword [ebp + 0x7c50e402], 0xfe15ff52
rol dword [eax + 0x74], 0xdd
pop ebp
or ch, bl
inc ebp
in al, dx
fcomp qword [0x40c230]
add esp, 0xc
fistp word [edi]
not byte [ecx + 0x44]
jnp 0x407fa2
inc edi
jae 0x407fae
mov dh, bl
jbe 0x407fba
fld qword [ebp - 0x14]
in eax, dx
sbb eax, 0x9840c230
adc eax, 0x44c4f6e0
jnp 0x407fba
fld qword [ebp - 0x14]
fmul qword [0x40c310]
lea eax, [ebp - 0x14]
push 0x2208ec83
sbb al, 0x24
call dword [sym.imp.MSVCRT.dll_modf]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x40c311]
add esp, 0xc
dec esi
inc eax
or eax, 0x40c300
push eax
fimul dword [eax + eax + 0x205d8b00]
mov cl, 0x64
invalid
push cs
mov ecx, dword [ebp - 4]
inc ecx
cmp esi, ebx
mov dword [ecx - 4], ebp
sbb byte [eax + 0x3b5043e4], ch
jb 0x408033
in al, 0x43
push eax
cmp esi, dword [edx + 0x73]
pop esp
loope 0x407fd9
arpl word [edi], dx
inc edi
inc esi
cmp edi, edi
jb 0x407fc1
jmp 0x40801d
mov esp, 0x75000041
fst qword ds:[edx - 0x77]
fcomp qword [ebx - 8]
ret 0x40
mov eax, dword [eax + edx]
add al, 0x10
lea esi, [eax + ebx]
mov eax, dword [ebp + 0x1c]
test eax, eax
xchg ebp, eax
add eax, edx
jne 0x40801e
mov ecx, dword [ebp + 0x14]
cmp esi, ebx
not dword [ebx]
mov eax, dword [ebp + 0x3e]
pop edi
test dword [esi + 0x3c60178], 0xf1c38b00
xchg ebp, eax
or esp, ebp
jmp 0xfc960c0d
adc ecx, dword [ebx - 0x8a0c1bb]
invalid