joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x43e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x4131f3
xor eax, eax
jmp 0x41324f
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x413220
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x413220
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4132d6
cmp dword [edi + 0x4c], 0
je 0x413249
mov ecx, edi
call fcn.00412e77
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x41325f
push dword [edi + 0x4c]
push ebx
call fcn.004129bb
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x41324e
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004144ac
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4311a4]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x4132a9
sub eax, 1
je 0x4132a9
dec eax
sub eax, 1
jne 0x413249
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x41323b
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4132c6
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0041c015
add esp, 0x10
cmp esi, eax
jne 0x413249
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x413249
mov ax, bx
jmp 0x41324e

Function at 0x415192
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4151d1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4151d1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4151d1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4151d1
cmp dword [ecx + 0x74], 0xe
jbe 0x4151d1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x424def
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424aa0

Function at 0x424dfa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424c2a

Function at 0x42eb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42eb6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42eb6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x64002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6401cf28]
push edi
xor edi, edi
test esi, esi
jne 0x64002a70
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push str._sdriversetchosts
push edx
call fcn.64004b03
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x210]
call fcn.64002550
test eax, eax
jne 0x64002ab0
mov esi, dword [ebp - 0x210]
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
jne 0x64002a2b
mov edi, dword [ebp - 0x210]
call fcn.64001930
test eax, eax
je 0x64002a13
mov ecx, dword [0x6401cf28]
mov dword [edi + 0x10], ecx
mov dword [0x6401cf28], edi
jmp 0x64002a1a
mov eax, edi
call fcn.64001a60
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
je 0x640029f3
mov eax, dword [esi + 4]
test eax, eax
je 0x64002a42
push eax
call fcn.64003b3b
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x64002a59
push eax
call fcn.640041a3
add esp, 4
mov dword [esi + 8], 0
push esi
call fcn.64003b3b
mov esi, dword [0x6401cf28]
add esp, 4
test esi, esi
je 0x64002a85
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.64001990
test eax, eax
jne 0x64002a99
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x64002a70
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4

Function at 0x64003b2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6401c014]
jne 0x64003b36
repz ret
jmp fcn.64006f23

Function at 0x640086cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dh, al
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.64007eaf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
adc al, 0xf7
invalid
Function at 0x64008d72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.64007e7d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.64007eaf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.64007e64
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.64007e9f
test al, 0x1f
xchg ebx, eax
mov esi, 0x10468
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x64009ec2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x64009f45
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x64009a1a
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
call dword [esi - 0x7537a3a]
invalid
jmp dword [edi - 0x7527a3a]
invalid
dec dword [eax - 0x7517a3a]
invalid
inc dword [edx - 0x7507a3a]
invalid
call dword [esi - 0x74f7a3a]
invalid
dec dword [eax - 0x74e7a3a]
invalid
dec dword [ecx - 0x74d7a3a]
invalid
dec dword [ebp - 0x74c7a3a]
invalid
call ebp
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.64007eaf
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.64007eaf
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.64007e10
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x64009e17
cmp dword [ebp - 0x6fc], 1
jne 0x64009acb
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x64009eee
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x64009f35
lea eax, [ebp - 0x714]
push eax
call fcn.64007eaf
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.64007e64
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x64009f40
jmp 0x64009f45
jmp 0x64009841
Function at 0x401fd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xedb88320
mov dword [ebp - 4], 0
jmp 0x401fef
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x402044
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 8
jmp 0x402010
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jle 0x402035
mov eax, dword [ebp - 8]
and eax, 1
je 0x40202b
mov ecx, dword [ebp - 8]
shr ecx, 1
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x402033
mov edx, dword [ebp - 8]
shr edx, 1
mov dword [ebp - 8], edx
jmp 0x402007
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x41c0e0], ecx
jmp 0x401fe6
mov esp, ebp
pop ebp
ret

Function at 0x403310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41b170]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ax, word [0x417448]
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0040ab30
add esp, 0xc
mov dword [ebp - 8], 0x208
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 4]
call fcn.00404660
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40338e
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 4]
call fcn.004046e0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402750
lea ecx, [ebp - 4]
call fcn.00402770
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040ac27
mov esp, ebp
pop ebp
ret
Function at 0x4036e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00404150
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x41d1b0
call fcn.00404180
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00404660
lea ecx, [ebp - 8]
call fcn.00402730
lea ecx, [ebp - 0x10]
call fcn.00403b00
movzx edx, al
test edx, edx
je 0x403772
lea eax, [ebp - 0x18]
push eax
call fcn.004033c0
add esp, 4
mov ecx, dword [eax]
push ecx
push str.http:__www.jisupdftoword.com__regdesktn_s
lea edx, [ebp - 8]
push edx
call fcn.00402a80
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402770
jmp 0x40377e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.00403850
push str.http
push 4
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 8]
call fcn.00403a10
push eax
call fcn.00403ae0
add esp, 8
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x20]
call fcn.00402770
movzx edx, byte [ebp - 0x19]
test edx, edx
je 0x4037f1
push 1
push 0
push 0
lea ecx, [ebp - 8]
call fcn.00408e40
push eax
push 0x4175a0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x20
jg 0x4037f1
push 1
push 0
lea ecx, [ebp - 8]
call fcn.00408e40
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x41d1b0
call fcn.004042d0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 8]
call fcn.00402770
lea ecx, [ebp - 0x10]
call fcn.00402770
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x41b170]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00403fa0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00408dd0
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00406340
lea ecx, [ebp - 0x438]
call fcn.00408dd0
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405df0
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4060ce
call fcn.00405a20
mov dword [ebp - 0x444], eax
jmp 0x406223
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x4060ff
call fcn.00405a20
mov dword [ebp - 0x444], eax
jmp 0x406223
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x40612f
call fcn.00405a20
mov dword [ebp - 0x444], eax
jmp 0x406223
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x40617f
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.00408df0
lea ecx, [ebp - 0x2c]
call fcn.00408aa0
mov eax, dword [ebp - 0x44c]
jmp 0x406258
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00408e10
lea ecx, [ebp - 0x438]
call fcn.00408e40
test eax, eax
jne 0x4061ac
mov dword [ebp - 0x444], 0x8007000e
jmp 0x406223
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00408e40
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00403fa0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x4061ee
call fcn.00405a20
mov dword [ebp - 0x444], eax
jmp 0x406223
lea ecx, [ebp - 0x438]
call fcn.00408e40
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.00408e40
push eax
lea ecx, [ebp - 0x18]
call fcn.00406370
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x406233
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.00408df0
lea ecx, [ebp - 0x2c]
call fcn.00408aa0
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0040ac27
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407b50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41b170]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00407920
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00407af0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x407bbb
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00407950
mov eax, dword [ebp - 0x224]
jmp 0x407c4c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x407c21
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00407b50
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x407c18
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00407950
mov eax, dword [ebp - 0x228]
jmp 0x407c4c
mov dword [ebp - 4], 0x100
jmp 0x407bc2
lea ecx, [ebp - 0x14]
call fcn.00407a30
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.004079d0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00407950
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040ac27
mov esp, ebp
pop ebp
ret 4
Function at 0x4081b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x4081b9
xor ecx, ecx
jne 0x4081b9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x4081da
mov eax, 0xd
jmp 0x408235
xor eax, eax
jne 0x4081c1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x4081eb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x4091f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x10325476
push 0x40
push 0
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
mov ecx, dword [ebp - 4]
call fcn.0040a3f0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x5c], 0x80
mov esp, ebp
pop ebp
ret

Function at 0x40ac27
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b170]
jne 0x40ac31
repz ret
jmp fcn.0040dd10
Function at 0x4154ea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ecab
and dword [ebp - 4], 0
cmp dword [0x41dd0c], 0
mov ebx, eax
jne 0x41559b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41564c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41564c
push eax
call fcn.0040ec39
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41dd0c], eax
call esi
push eax
call fcn.0040ec39
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41dd10], eax
call esi
push eax
call fcn.0040ec39
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41dd14], eax
call esi
push eax
call fcn.0040ec39
pop ecx
mov dword [0x41dd1c], eax
test eax, eax
je 0x41559b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ec39
pop ecx
mov dword [0x41dd18], eax
mov eax, dword [0x41dd18]
cmp eax, ebx
je 0x4155f3
cmp dword [0x41dd1c], ebx
je 0x4155f3
push eax
call fcn.0040ecb4
push dword [0x41dd1c]
mov esi, eax
call fcn.0040ecb4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4155f3
test edi, edi
je 0x4155f3
call esi
test eax, eax
je 0x4155ea
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4155ea
test byte [ebp - 0xc], 1
jne 0x4155f3
or dword [ebp + 0x10], 0x200000
jmp 0x41562c
mov eax, dword [0x41dd10]
cmp eax, ebx
je 0x41562c
push eax
call fcn.0040ecb4
pop ecx
test eax, eax
je 0x41562c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41562c
mov eax, dword [0x41dd14]
cmp eax, ebx
je 0x41562c
push eax
call fcn.0040ecb4
pop ecx
test eax, eax
je 0x41562c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41dd0c]
call fcn.0040ecb4
pop ecx
test eax, eax
je 0x41564c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41564e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret