joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040c230
xor eax, eax
push fcn.0053b6f0
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, 0x5ea928
call fcn.00493e80
mov edx, dword [ebp - 0x10]
lea ebx, [edx + 4]
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0x30]
mov byte [ebx + 0xc], al
mov dword [ebx + 4], edi
mov dword [ebx + 8], esi
mov eax, 0x5398e0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0x48]
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0x30]
test al, al
jne 0x53b79d
mov eax, 0x5ea928
cmp eax, esi
je 0x53b79d
mov eax, 0x5eaeb0
cmp eax, esi
jne 0x53b811
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x53b7c0
sub eax, 1
je 0x53b7d0
sub eax, 1
je 0x53b7f0
sub eax, 1
je 0x53b7e0
sub eax, 1
je 0x53b800
jmp 0x53b89c
mov eax, 0x539900
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], eax
jmp 0x53b89c
mov eax, 0x539eb0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], eax
jmp 0x53b89c
mov edx, 0x53a4f0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov edx, 0x53aab0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov eax, 0x53b070
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], eax
nop
jmp 0x53b89c
mov edx, dword [ebp - 0x10]
lea ebx, [edx + 4]
mov eax, esi
lea ecx, [ebp - 0xc]
mov edx, 0x5ea928
call fcn.004a6dd0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x53b850
sub eax, 1
je 0x53b860
sub eax, 1
je 0x53b870
sub eax, 1
je 0x53b880
sub eax, 1
je 0x53b890
jmp 0x53b89c
mov edx, 0x539ac0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov edx, 0x53a0a0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov edx, 0x53ac40
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov edx, 0x53a680
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
jmp 0x53b89c
mov edx, 0x53b290
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], edx
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0053b6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53ccb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040c230
xor eax, eax
push fcn.0053cca0
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0x30]
test al, al
je 0x53cd07
push esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x28]
jmp 0x53ce54
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov edi, edx
mov eax, esi
test esi, esi
je 0x53cdb4
sub eax, 1
je 0x53ce20
sub eax, 1
je 0x53cd40
sub eax, 1
je 0x53cd7c
sub eax, 1
je 0x53cde8
jmp 0x53ce54
mov eax, dword [ebp - 0x10]
lea ebx, [eax - 1]
test ebx, ebx
jl 0x53ce54
mov esi, 0xffffffff
lea esi, [esi]
nop
add esi, 1
mov eax, edi
mov edx, dword [ebp - 0x14]
call edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.0053dfb0
add dword [ebp - 0xc], 4
cmp ebx, esi
jg 0x53cd58
nop
jmp 0x53ce54
mov edx, dword [ebp - 0x10]
lea ebx, [edx - 1]
test ebx, ebx
jl 0x53ce54
mov esi, 0xffffffff
nop
add esi, 1
mov eax, edi
mov edx, dword [ebp - 0x14]
call edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.0053da30
add dword [ebp - 0xc], 4
cmp ebx, esi
jg 0x53cd90
nop
jmp 0x53ce54
mov edx, dword [ebp - 0x10]
lea ebx, [edx - 1]
test ebx, ebx
jl 0x53ce54
mov esi, 0xffffffff
nop
add esi, 1
mov eax, edi
mov edx, dword [ebp - 0x14]
call edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
add dword [ebp - 0xc], 4
cmp ebx, esi
jg 0x53cdc8
nop
jmp 0x53ce54
mov edx, dword [ebp - 0x10]
lea ebx, [edx - 1]
test ebx, ebx
jl 0x53ce54
mov esi, 0xffffffff
lea esi, [esi]
nop
add esi, 1
mov eax, edi
mov edx, dword [ebp - 0x14]
call edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
add dword [ebp - 0xc], 4
cmp ebx, esi
jg 0x53ce00
jmp 0x53ce54
mov edx, dword [ebp - 0x10]
lea ebx, [edx - 1]
test ebx, ebx
jl 0x53ce54
mov esi, 0xffffffff
nop
add esi, 1
mov eax, edi
mov edx, dword [ebp - 0x14]
call edx
mov dword [ebp - 8], eax
cmp byte [ebp - 5], 0xff
jne 0x53ce4c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
nop
add dword [ebp - 0xc], 4
cmp ebx, esi
jg 0x53ce30
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0053cca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53d7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov edi, edx
mov esi, ecx
mov edx, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov byte [ebp - 8], al
test edx, edx
je 0x53d834
sub edx, 1
je 0x53d864
sub edx, 1
je 0x53d968
sub edx, 1
je 0x53d8f4
sub edx, 1
je 0x53d9d4
jmp 0x53da24
cmp byte [ebp - 8], 0xff
je 0x53d84d
push esi
mov cl, byte [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.0053dab0
jmp 0x53da24
mov eax, esi
shl eax, 2
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00402930
jmp 0x53da24
cmp byte [ebp - 8], 0xff
je 0x53d8b9
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
lea esi, [esi]
sub ebx, 1
cmp byte [edi + 3], 0xff
jne 0x53d8a8
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov al, byte [ebp - 1]
mov dl, byte [ebp - 8]
call fcn.0053db00
mov byte [ebp - 1], al
push dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0053dfb0
nop
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d880
nop
jmp 0x53da24
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
lea esi, [esi]
sub ebx, 1
cmp byte [edi + 3], 0xff
jne 0x53d8e0
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d8d0
nop
jmp 0x53da24
cmp byte [ebp - 8], 0xff
je 0x53d931
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
lea esi, [esi]
sub ebx, 1
push dword [edi]
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0053da70
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d910
nop
jmp 0x53da24
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
lea esi, [esi]
sub ebx, 1
push dword [edi]
mov eax, dword [ebp - 0xc]
call fcn.0053da30
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d948
jmp 0x53da24
cmp byte [ebp - 8], 0xff
je 0x53d9a1
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
mov esi, esi
sub ebx, 1
push dword [edi]
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0053e1c0
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d980
nop
jmp 0x53da24
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
lea esi, [esi]
sub ebx, 1
push dword [edi]
mov eax, dword [ebp - 0xc]
call fcn.0053dfb0
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d9b8
jmp 0x53da24
cmp byte [ebp - 8], 0xff
je 0x53da16
lea eax, [esi - 1]
test eax, eax
jl 0x53da24
mov ebx, eax
add ebx, 1
mov esi, esi
sub ebx, 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov edx, dword [edi]
xor edx, eax
lea eax, [ebp - 4]
mov dword [eax], edx
push dword [ebp - 4]
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0053e1c0
add dword [ebp - 0xc], 4
add edi, 4
test ebx, ebx
jg 0x53d9e8
mov esi, esi
jmp 0x53da24
mov ecx, esi
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.0053ce70
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x573650
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.00573640
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x62f070], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.00573910
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x62f060]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.00402930
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.00403aa0
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.00409b90
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.00402930
mov ebx, 1
jmp 0x5738cf
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x573732
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x573718
cmp dword [ebp - 0x214], ebx
jl 0x5738db
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x5737cb
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x5737c0
sub ax, 0x20
jbe 0x57377c
sub ax, 2
je 0x573790
jmp 0x5737c0
mov al, byte [ebp - 0x218]
test al, al
je 0x5737d3
add dword [ebp - 0x210], 1
jmp 0x5737c8
cmp dword [ebp - 0x214], ebx
jle 0x5737bb
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x5737bb
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x5737c8
add ebx, 1
jmp 0x5737c8
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x573758
cmp dword [0x62f070], 0
jle 0x5738c8
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x62f070]
mov eax, ebp
call fcn.00573910
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x5738bb
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x573894
sub ax, 0x20
jbe 0x573830
sub ax, 2
je 0x573864
jmp 0x573894
mov al, byte [ebp - 0x218]
test al, al
je 0x5738c7
mov edx, dword [0x62f060]
mov eax, dword [0x62f070]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x5738b8
cmp dword [ebp - 0x214], ebx
jle 0x57388f
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x57388f
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x5738b8
add ebx, 1
jmp 0x5738b8
mov eax, dword [0x62f060]
mov edx, dword [0x62f070]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x573808
nop
add dword [0x62f070], 1
cmp dword [ebp - 0x214], ebx
jge 0x57371b
sub dword [0x62f070], 1
cmp word [0x619040], 0xfde9
jne 0x5738f4
call fcn.00573550
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00573640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x573a60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x573aea
lea edx, [eax - 2]
test edx, edx
jl 0x573aff
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x573aff
sub di, 0x20
je 0x573ae4
sub di, 0x80
je 0x573ae4
sub di, 0x1f62
jb 0x573aff
sub di, 1
jbe 0x573ae4
sub di, 6
je 0x573ae4
sub di, 0x26
jne 0x573aff
mov esi, esi
jmp 0x573ae4
cmp edx, ecx
jg 0x573a98
jmp 0x573aff
cmp eax, 2
jne 0x573af5
mov si, word [ebp - 8]
jmp 0x573aff
mov al, bl
call fcn.0040a600
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x573b78
sub ax, 0x21
je 0x573b88
sub ax, 0x17
je 0x573b8c
sub ax, 0x222
je 0x573b90
sub ax, 0x392
je 0x573b94
sub ax, 1
je 0x573b98
sub ax, 0x1996
je 0x573b9c
sub ax, 1
je 0x573ba0
sub ax, 6
je 0x573ba4
sub ax, 0xb
je 0x573bac
sub ax, 0x1b
je 0x573ba8
sub ax, 0x367
je 0x573bb0
jmp 0x573bb4
mov ax, si
call fcn.0040a670
jmp 0x573bb8
mov al, 0x20
jmp 0x573bb8
mov al, 0x2e
jmp 0x573bb8
mov al, 0x27
jmp 0x573bb8
mov al, 0x2c
jmp 0x573bb8
mov al, 0x27
jmp 0x573bb8
mov al, 0x20
jmp 0x573bb8
mov al, 0x20
jmp 0x573bb8
mov al, 0x20
jmp 0x573bb8
mov al, 0x20
jmp 0x573bb8
mov al, 0x2d
jmp 0x573bb8
mov al, 0x27
jmp 0x573bb8
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40c7d0
mov ecx, 0x3a5d2ba5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text
mov ebx, 0x42f314
nop
mov ecx, 0xec193e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2df74c4a
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4bd40d11
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401360
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5899c0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
xor ebx, ebx
mov dword [esp + 0x60], ebx
push 0x39
xor eax, eax
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
lea esi, [esp + 0x24]
mov byte [esp + 0x1f], 1
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], ax
call fcn.00406150
lea ecx, [esp + 0x68]
push ecx
mov ecx, esi
lea edi, [esp + 0x3c]
mov byte [esp + 0x64], 1
call fcn.004048d0
mov eax, dword [esp + 0x40]
mov edi, 8
add esp, 4
cmp dword [esp + 0x50], edi
jae 0x4013f2
lea eax, [esp + 0x3c]
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x20006
push 1
push ebx
push ebx
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401442
mov ecx, dword [esp + 0x18]
push 4
lea eax, [esp + 0x8c]
push eax
push 4
push ebx
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401433
mov byte [esp + 0x17], bl
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x401446
mov byte [esp + 0x17], bl
cmp dword [esp + 0x50], edi
jb 0x401459
mov eax, dword [esp + 0x3c]
push eax
call fcn.005273b8
add esp, 4
xor ecx, ecx
mov esi, 7
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
cmp dword [esp + 0x34], edi
jb 0x401480
mov edx, dword [esp + 0x20]
push edx
call fcn.005273b8
add esp, 4
xor eax, eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
cmp dword [esp + 0x80], edi
jb 0x4014a5
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.005273b8
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005273c3
add esp, 0x50
ret

Function at 0x4014d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x208
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x210]
push ebx
mov ebx, dword [esp + 0x210]
push esi
push 0xffffffffffffffff
push 0
mov esi, ecx
push eax
mov ecx, edi
call fcn.00405870
cmp dword [esi + 0x18], 0x10
mov dword [esp + 8], 0x200
jb 0x401515
mov esi, dword [esi + 4]
jmp 0x401518
add esi, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x401556
lea eax, [esp + 0xc]
lea edx, [eax + 1]
jmp 0x401540
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401540
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00405bb0
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.005273c3
add esp, 0x208
ret
Function at 0x411c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x586b42
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
fldz
xor eax, eax
mov ecx, 1
fstp qword [edi + 0x50]
mov byte [edi], cl
mov byte [edi + 1], cl
mov dword [edi + 0x1c], ecx
mov ecx, 2
mov dword [edi + 0x34], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ecx
lea esi, [edi + 0x78]
mov ebx, 5
lea ecx, [esi + 4]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], ebx
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0x10
mov dword [edi + 0x2c], 0x19
mov dword [edi + 0x30], eax
mov dword [edi + 0x38], 0x3c
mov dword [edi + 0x3c], 0x16
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], 0xff000000
xor edx, edx
mov dword [esi], ecx
mov word [ecx], dx
mov dword [esp + 0x1c], eax
mov dword [edi + 0xfc], eax
mov ecx, 4
mov dword [edi + 0x100], eax
mov dword [edi + 0x104], ecx
mov dword [edi + 0x108], eax
mov dword [edi + 0x10c], eax
mov dword [edi + 0x110], eax
mov dword [edi + 0x114], ecx
mov dword [edi + 0x118], eax
mov dword [edi + 0x11c], eax
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], 0x84
mov dword [edi + 0x128], eax
mov dword [edi + 0x12c], eax
push 0xffffffffffffffff
push 0x59bce0
mov byte [esp + 0x24], 3
call fcn.004671e0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x18]
cmp eax, ecx
mov edx, dword [edi + 0x1c]
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
jg 0x411d6a
mov eax, ecx
mov esi, dword [edi + 0xc]
mov ebx, dword [edi + 0x14]
cmp esi, ebx
jl 0x411d76
mov esi, ebx
push edx
push eax
push esi
push edi
call fcn.00411e00
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4151e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x587518
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], al
mov byte [esi + 0x11], al
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x30], vtable.UiLib::INotifyUI.0
lea edi, [esi + 0x34]
mov dword [esi], vtable.UiLib::CComboWnd.0
mov dword [esi + 0x30], vtable.UiLib::CComboWnd.1.0
call fcn.004485d0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x416b20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x98
push ebx
mov dword [edi + 0x30], eax
push ebp
mov dword [eax + 0x6d4], 0
cmp dword [edi + 4], 0
push esi
jne 0x416ba6
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
call edx
mov ecx, dword [eax + 4]
mov ebp, dword [eax]
mov esi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [edi + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esp + 0x14]
sub ebx, ecx
push ebx
sub esi, ebp
push esi
push ecx
mov ecx, dword [eax]
push ebp
push 0
push 0x40000000
push ecx
mov eax, edi
call fcn.00439bf0
mov ecx, dword [edi + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
mov ebx, dword [ecx + 0x5e4]
call eax
mov esi, eax
mov eax, ebx
call fcn.0044cb40
mov ecx, dword [eax]
mov edx, dword [edi + 4]
push 1
push ecx
push 0x30
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x20]
push edx
call eax
mov ecx, dword [eax]
cmp word [ecx], 0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
sete bl
cmp eax, edx
je 0x416bd3
push eax
call fcn.005282dc
add esp, 4
test bl, bl
je 0x416be6
mov eax, dword [edi + 0x30]
add eax, 0x6c4
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 4]
add ecx, 0x6c4
push ecx
push 0
push 0x1002
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
pop ebp
mov byte [edi + 0x38], 1
pop ebx
add esp, 0x98
ret