joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x430b67
add esp, 0xfffffff0
call fcn.00465354
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00457ad0
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x450d7c]
call fcn.00465024
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x450d7c]
call fcn.00465024
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41e768]
call fcn.00425904
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x430cdc
mov eax, dword [0x47bc20]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425cd4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x432660
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47bc20]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0046176c
test eax, eax
je 0x430c5a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0045e104
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00461794
test eax, eax
je 0x430c6e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00465ee0
mov eax, dword [0x47bc28]
cmp byte [eax], 0
jne 0x430c9f
mov eax, ebx
call fcn.00430dc8
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x430cd1
call fcn.004653ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431038
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47d728]
cmp dword [eax + 0x24], 0
je 0x4310db
cmp dword [ebx + 0x84], 0
jne 0x4310d5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x430fc8
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4310d5
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x43109e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4310d5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00452578
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4310ad
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x431ae8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x431b1d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00465d98
jmp 0x431b27
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00465d04
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4329d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x432a0c
mov eax, esi
call fcn.00442040
test al, al
je 0x432a0c
mov eax, dword [ebx + 0x74]
call fcn.00441d44
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x432a0c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00441d44
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x439a08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x47d7c4], 0
sete dl
or al, dl
jne 0x439b48
mov eax, dword [0x47d7c8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x47d7c4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x439b17
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x47d7c4]
call fcn.00452578
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x439b0f
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x439b0f
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x439b0f
mov eax, dword [ebp - 0x14]
call fcn.00441d44
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x439b0f
push ebp
call fcn.004399c4
pop ecx
test al, al
jne 0x439b0f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x439acb
mov eax, dword [ebp - 0x14]
call fcn.004406d0
dec eax
jle 0x439b0f
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00465230
cmp byte [ebp - 1], 0
je 0x439b0f
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x439b0f
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47d7c8]
call fcn.00439210
inc edi
dec esi
jne 0x439a5e
mov eax, dword [0x47d7c8]
cmp dword [eax + 8], 0
jle 0x439b2f
mov eax, dword [0x47d7c8]
call fcn.004392a0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x439b48
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043982c
pop ecx
test al, al
jne 0x439b48
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f6dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43f70d
je 0x43f767
sub eax, 7
je 0x43f72e
dec eax
je 0x43f758
sub eax, 0x17
je 0x43f80c
jmp 0x43f84a
add eax, 0xffffff00
sub eax, 9
jb 0x43f7f8
add eax, 0xffffff09
sub eax, 0xb
jb 0x43f7c0
jmp 0x43f84a
mov eax, ebx
call fcn.00429734
mov edi, eax
test edi, edi
je 0x43f8aa
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x43f8b3
jmp 0x43f8aa
test byte [ebx + 0x44], 0x20
jne 0x43f8b3
jmp 0x43f8aa
mov edx, esi
mov eax, ebx
call fcn.0043ccdc
cmp dword [esi + 0xc], 0xffffffff
jne 0x43f8b3
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.0045b92c
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0043b810
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043f5b4
test eax, eax
je 0x43f8b3
mov dword [esi + 0xc], 1
jmp 0x43f8b3
mov edx, esi
mov eax, ebx
call fcn.0043f648
test al, al
je 0x43f8aa
cmp dword [esi + 0xc], 0
jne 0x43f8b3
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00441d44
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x43f8b3
mov eax, ebx
call fcn.0043c378
test al, al
jne 0x43f8b3
jmp 0x43f8aa
mov eax, ebx
call fcn.00441d44
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x43f8aa
cmp dword [0x477cb8], 0
je 0x43f8aa
mov eax, dword [0x477cb8]
cmp ebx, dword [eax + 0x24]
jne 0x43f8aa
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x477cb8]
call fcn.0043cc10
jmp 0x43f8aa
mov eax, dword [0x47d78c]
cmp byte [eax + 0x20], 0
je 0x43f8aa
mov eax, dword [0x47d78c]
cmp dword [eax + 0x1c], 0
je 0x43f8aa
mov eax, dword [esi]
mov edx, dword [0x47d78c]
cmp eax, dword [edx + 0x1c]
jne 0x43f8aa
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00429678
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00465230
jmp 0x43f8b3
mov edx, esi
mov eax, ebx
call fcn.0043ccdc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fd74
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43fd90
cmp dword [esi + 4], 0
je 0x43fdbd
test byte [ebx + 0x45], 1
jne 0x43fdaf
mov eax, ebx
call fcn.0043ecac
test eax, eax
jne 0x43fdaf
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43fecd
mov edx, esi
mov eax, ebx
call fcn.0043f9ec
jmp 0x43fecd
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43fec6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00441d44
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043cc10
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043fd74
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00441d44
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fecd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4492f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4493d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47d810], 0
jne 0x4493b4
lea eax, [ebp - 4]
mov edx, 0x4493e8
call fcn.00465d48
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004660f4
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4493b4
mov eax, ebx
call fcn.00464934
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4493ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x449397
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4493f8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x449397
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x47d810], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4493b4
mov eax, dword [ebp - 0xc]
call fcn.0046494c
ret
mov ebx, dword [0x47d810]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4493d7
lea eax, [ebp - 4]
call fcn.00465cb0
ret

Function at 0x457a4c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x457a61
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x45e074
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00465d98
add esp, 0x104
pop ebx
ret

Function at 0x4602bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4602f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00465d98
jmp 0x4602fe
mov eax, ebx
mov edx, esi
call fcn.00465d04
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x460308
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x460329
mov al, byte [esp]
jmp 0x46032b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x464b78
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x464ba7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00465d98
jmp 0x464bc5
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00464b00
mov edi, eax
test ebx, ebx
je 0x464bc5
cmp dword [esi], 0
je 0x464bc5
dec ebx
jmp 0x464bae
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x464ecc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x478108]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x464f64
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x464f44
xor eax, eax
push ebp
push 0x464f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x464f80
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f44
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x478108]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x478108], ax
mov esp, ebp
pop ebp
ret

Function at 0x465c64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00464934
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x47dac9], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x465c2c
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x467228
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4673e4
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x467289
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x467400
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4672fb
xor eax, eax
push ebp
push 0x4672f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00467080
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4672dd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x467420
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4672fb
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4673dc
cmp byte [ebp - 0xd], 0
jne 0x46733d
cmp byte [ebp - 0x12], 0
je 0x4673dc
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x467356
dec ebx
cmp byte [ebx], 0x2e
je 0x467365
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x467355
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4673dc
inc ebx
cmp byte [ebp - 0x12], 0
je 0x467392
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4673dc
cmp byte [ebp - 0xd], 0
je 0x4673dc
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4673dc
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4677d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4678b8
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x47deac], 1
jae 0x4678aa
xor eax, eax
mov dword [0x47dab8], eax
xor eax, eax
mov dword [0x47dac0], eax
xor eax, eax
mov dword [0x47dac4], eax
mov byte [0x47daca], 2
mov byte [0x47dacb], 2
mov byte [0x47dacc], 3
mov word [0x47de74], 0
mov word [0x47de84], 1
mov word [0x47de94], 0xa
mov dword [0x47de9c], 0x80020004
mov dword [0x47de68], 0x4669bc
mov dword [0x47de6c], 0x4669b4
mov dword [0x47de70], 0x4669bc
call fcn.00464e9c
test al, al
je 0x467869
call fcn.00464ecc
call fcn.00464f90
mov eax, 0x47dad0
mov edx, 0x4678c4
call fcn.0046268a
mov eax, 0x47dc9c
mov edx, 0x4678c4
call fcn.0046268a
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x47dab0], eax
call fcn.004635f0
mov dword [0x47daac], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x47daa4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4678bf
ret

Function at 0x46d450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x46d4b2
call fcn.0046d400
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00468408
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00468408
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46d530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x479f64], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x46d60a
cmp dword [0x479f60], 0
jne 0x46d60a
cmp dword [0x47a144], 0
je 0x46d5c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0046d300
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46d5aa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0046d300
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46d5aa
lea ebx, [ebp - 0x84]
jmp 0x46d5ab
inc ebx
call fcn.0046d4ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x46d645
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x479f68
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00468408
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x479f6b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x46d645
cmp dword [0x479f60], 0
je 0x46d624
cmp dword [0x479f60], 0xffffffff
je 0x46d645
push esi
call dword [0x479f60]
pop ecx
mov eax, dword [0x479f64]
test eax, eax
je 0x46d645
cmp dword [0x479f64], 0xffffffff
je 0x46d645
cmp byte [eax], 0
je 0x46d645
push esi
push eax
call fcn.0046d450
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x344440df
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4b66155d
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4019ae
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 5
lea eax, [ebp - 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [ebp - 0x1a]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call eax
sub esp, 0x2c
test eax, eax
sete al
test al, al
je 0x401a55
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
jmp 0x401a88
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call eax
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x401a88
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x401aa6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_FreeSid]
call eax
sub esp, 4
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0xc], 0
je 0x401ad5
mov dword [esp], 4
call sym.___cxa_allocate_exception
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4cb194
mov dword [esp], eax
call sym.___cxa_throw
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x403b8a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403bcc
mov eax, 0
jmp 0x403bf9
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
leave
ret