joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fd0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
mov edi, edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407080
push 0
lea eax, [ebp - 8]
push eax
push reloc.advapi32.dll_CryptAcquireContextA
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0x40
jne 0x407080
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x407080
push 0
push 0
push dword [edi + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x407080
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push 0
push eax
push 0xf8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0xf8
jne 0x407080
cmp dword [edi], 0x4550
jne 0x407080
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042318e
mov esp, ebp
pop ebp
ret
Function at 0x40d110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44127b
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x120]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsPPStream.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d1b5
push CryptGetHashParam
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], CryptGetHashParam
push eax
call fcn.00426340
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x120]
test eax, eax
je 0x40d1bc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d252
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x114], 0
jne 0x40d1cf
xor ecx, ecx
jmp 0x40d1e1
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d1d8
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00402970
push 4
push ecx
push str..exe
mov ecx, esi
call fcn.0040d2f0
cmp eax, 0xffffffff
jne 0x40d218
push 4
push ecx
push str..EXE
mov ecx, esi
call fcn.0040d2f0
cmp eax, 0xffffffff
je 0x40d1b5
add eax, 4
mov ecx, esi
push eax
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00402420
mov dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.0040d270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.004024e0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret 4
Function at 0x40dcf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44135c
mov eax, dword fs:[0]
push eax
mov eax, 0x11f8
call fcn.00423fc0
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1204]
mov byte [ebp - 0x11fd], 0
push eax
lea ecx, [ebp - 0x16c]
call fcn.0041df30
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x15c], 0
je 0x40df29
xor eax, eax
xorps xmm0, xmm0
push 0x848
push eax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x11fc]
push eax
movups xmmword [ebp - 0x36], xmm0
call fcn.00426340
add esp, 0xc
lea eax, [ebp - 0x16c]
cmp dword [ebp - 0x158], 0x10
lea ecx, [ebp - 0x11fc]
cmovae eax, dword [ebp - 0x16c]
push eax
call fcn.0040f760
mov byte [ebp - 4], 1
lea eax, [ebp - 0x13c]
movq xmm0, qword [ebp - 0x11f4]
push CryptGetHashParam
push 0
push eax
movq qword [ebp - 0x38], xmm0
call fcn.00426340
add esp, 0xc
lea eax, [ebp - 0x13c]
push CryptGetHashParam
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x13c], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x140], 0xf
mov dword [ebp - 0x144], 0
mov byte [ebp - 0x154], 0
jne 0x40de08
xor ecx, ecx
jmp 0x40de1a
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40de11
sub ecx, edx
push ecx
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x154]
call fcn.00402740
mov byte [ebp - 4], 2
lea eax, [ebp - 0x9b4]
push 0x848
push 0
push eax
call fcn.00426340
add esp, 0xc
lea eax, [ebp - 0x154]
cmp dword [ebp - 0x140], 0x10
lea ecx, [ebp - 0x9b4]
cmovae eax, dword [ebp - 0x154]
push eax
call fcn.0040f760
mov byte [ebp - 4], 3
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
xor eax, eax
movq xmm0, qword [ebp - 0x9ac]
mov word [ebp - 0x12], ax
movq qword [ebp - 0x24], xmm0
nop word [eax + eax]
movzx ecx, word [ebp + eax - 0x24]
movzx edx, word [ebp + eax - 0x38]
cmp dx, cx
jb 0x40deab
ja 0x40deb2
add eax, 2
cmp eax, 8
jl 0x40de90
jmp 0x40deb2
mov byte [ebp - 0x11fd], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9b4]
call fcn.0040f800
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x140]
cmp eax, 0x10
jb 0x40dee3
inc eax
lea ecx, [ebp - 0x154]
push eax
push dword [ebp - 0x154]
call fcn.00402ba0
mov dword [ebp - 0x140], 0xf
mov dword [ebp - 0x144], 0
mov byte [ebp - 0x154], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11fc]
call fcn.0040f800
cmp byte [ebp - 0x11fd], 0
je 0x40df29
mov eax, dword [ebp - 0x1204]
test eax, eax
je 0x40df29
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x158]
cmp eax, 0x10
jb 0x40df4e
inc eax
lea ecx, [ebp - 0x16c]
push eax
push dword [ebp - 0x16c]
call fcn.00402ba0
mov al, byte [ebp - 0x11fd]
mov dword [ebp - 0x158], 0xf
mov dword [ebp - 0x15c], 0
mov byte [ebp - 0x16c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
Function at 0x40e880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4414a8
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], 0
call fcn.00426340
add esp, 0xc
lea eax, [ebp - 0x218]
push CryptGetHashParam
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges], ax
cmp word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges], ax
jne 0x40e928
xor ecx, ecx
jmp 0x40e940
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e931
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00409420
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x220]
test edi, edi
je 0x40ea8e
push 1
push ecx
push 0x455c5c
lea ecx, [ebp - 0x230]
call fcn.0040eb20
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40e9c5
push 1
push ecx
push 0x455c60
lea ecx, [ebp - 0x230]
call fcn.0040eb20
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40e9c5
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x220], 0
cmovae eax, dword [ebp - 0x230]
xor edx, edx
mov word [eax], dx
mov edi, dword [ebp - 0x220]
test edi, edi
je 0x40ea8e
lea eax, [ecx + 1]
push eax
push ecx
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040df90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x248]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x230]
call fcn.00409f00
push 0x11
push 0x455c64
lea ecx, [ebp - 0x230]
call fcn.0040a020
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ea7f
test al, 0x10
jne 0x40ea7f
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x230]
push eax
call fcn.0040e270
mov dword [ebp - 0x24c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00407960
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407960
jmp 0x40eaf7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00407960
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x4551f4
mov word [esi], ax
call fcn.00409420
mov dword [ebp - 0x24c], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x40eada
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00409ea0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret 4
Function at 0x410d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441d1c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 1
lea eax, [edi + 0x88]
mov dword [edi], 0x455df4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x410dc5
lea esi, [edi + 0x6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x84]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ecx
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00414a70
mov dword [ebp - 4], 3
mov ecx, dword [edi + 0xc8]
mov byte [ebp - 4], 0xb
mov eax, dword [edi + 0xc8]
push ecx
lea ecx, [edi + 0xc8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
call fcn.00412ba0
mov byte [ebp - 4], 0x13
mov eax, dword [edi + 0xc8]
push eax
mov byte [ebp - 4], 0x13
call fcn.004233d1
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xb4]
mov dword [ebp - 4], 0x27
call fcn.004125d0
mov byte [ebp - 4], 0x28
mov eax, dword [edi + 0xb4]
push eax
mov byte [ebp - 4], 0x28
call fcn.004233d1
add esp, 4
mov byte [ebp - 4], 0x28
mov dword [edi + 0xb4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xa0]
mov dword [ebp - 4], 0x35
call fcn.00412960
mov byte [ebp - 4], 0x36
mov eax, dword [edi + 0xa0]
push eax
mov byte [ebp - 4], 0x36
call fcn.004233d1
add esp, 4
mov byte [ebp - 4], 0x36
mov dword [edi + 0xa0], 0
mov dword [ebp - 4], 0x43
lea ecx, [edi + 0x8c]
mov byte [ebp - 4], 0x44
call fcn.00412960
mov byte [ebp - 4], 0x45
mov eax, dword [edi + 0x8c]
push eax
mov byte [ebp - 4], 0x45
call fcn.004233d1
add esp, 4
mov byte [ebp - 4], 0x45
mov ecx, edi
mov dword [edi + 0x8c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004108b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ddf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447968
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x41df03
mov eax, dword [esi]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x41df03
cmp dword [esi + 0x3c], 0
jne 0x41ded9
cmp dword [esi + 0x14], 0
je 0x41ded9
push 0x454304
lea edx, [esi + 4]
lea ecx, [ebp - 0x58]
call fcn.00413e10
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 0
push ecx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00413f00
push str..log
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040d3e0
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.004024e0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.004024e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push reloc.advapi32.dll_CryptAcquireContextA
cmovae eax, dword [ebp - 0x28]
push 0x458c00
push eax
call fcn.0042d0da
add esp, 0xc
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x41deca
call fcn.0042b9b4
mov eax, dword [eax]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004024e0
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x41df03
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dee5
push edx
sub eax, ebx
push eax
push 1
push edi
call fcn.0042b8e3
push dword [esi + 0x3c]
call fcn.0042b28c
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret 4
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x67
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xca
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x24
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xaf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x63
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1d
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x45
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x20
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x405198
Capabilities:
Encode data using xor

Disassembly:
call fcn.004050a2
mov ecx, 0x1bb
call 0x405198
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40519b
mov eax, 0x50402ab
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x406a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
xor esp, dword [ebp - 0x3c]
sub cl, byte [eax + 0xe]
lea esi, [ecx - 0x77]
jmp 0x406a60
Function at 0x406479
Capabilities:
Parse pe header

Disassembly:
jmp 0x451e78
push 0
call dword [0x599130]
test eax, eax
je 0x451eb7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x451eb7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x451eb7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x451eb7
cmp dword [ecx + 0x74], 0xe
jbe 0x451eb7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408935
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
add edi, 0xf83ded96
call fcn.00408958
sub ecx, ecx
xor dword [eax], edx
inc eax
sub edi, ecx
mov ecx, ecx
cmp eax, ebx
jne fcn.00408935
dec edi
sub ecx, edi
ret
Function at 0x912370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x91238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x93b074
push ecx
mov edi, eax
call fcn.00926198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9123cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0092602e
push esi
call fcn.00925fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x915850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x9158ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x940720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9158ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.009261e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x9158ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x940720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x91592a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00927082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x915957
mov word [eax], si
add eax, 2
push eax
call fcn.00927030
add esp, 4
jmp 0x915959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x9158ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x9158b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x915ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x916080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x9160c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x93b458
push ecx
call fcn.009261e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.009261e1
add esp, 0x10
jmp 0x9160d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0092620b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00925dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00916050
mov eax, dword [0x940728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], reloc.gdi32.dll_GetMetaFileBitsEx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x91613b
push esi
call fcn.00915fb0
add esp, 4
mov dword [0x940728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x91614c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00915ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x919440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x9194b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x91948e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x919471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x91947e
add edx, ecx
cmp ebx, edx
jb 0x91948a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x919467
xor ecx, ecx
jmp 0x9194a2
test eax, eax
jne 0x919492
xor ecx, ecx
jmp 0x9194a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.009193c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret