joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d840
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.00473cc0
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x46d939
lea ecx, [esp + 0x10]
push ecx
push str..htm
push closesocket
mov ecx, esi
call fcn.0046d950
test eax, eax
jne 0x46d939
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push closesocket
mov ecx, esi
call fcn.0046d950
test eax, eax
jne 0x46d939
lea edx, [esp + 0x10]
push 0x4e47b0
push edx
call fcn.00493710
mov esi, eax
add esp, 8
test esi, esi
jne 0x46d90a
lea eax, [esp + 0x10]
push 0x4e47ac
push eax
call fcn.00493710
mov esi, eax
add esp, 8
test esi, esi
jne 0x46d90a
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x46d90d
mov byte [esi], 0
push 0x4e3f74
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x46d950
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x46d9b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x473c00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b1a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x473cb0
mov eax, dword [0x4ef0a8]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004a30ef
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.004a313e
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004a309b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x473c97
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x473c97
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a2d0b
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x476db0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b1eb0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x476f57
mov ecx, dword [0x4ef0a8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x476eac
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00475ad0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004a2df8
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004a2d0b
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4e3f74
call fcn.004a2d79
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00475e90
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004a2df8
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004a2d0b
lea ecx, [esp + 0xc]
call fcn.004a31d3
mov ecx, dword [esp + 0xc]
push 0x4e49b4
push ecx
call fcn.004926d4
add esp, 8
test eax, eax
je 0x476ed4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x476e0d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004a2d0b
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a2d0b
jmp 0x476f5b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00476b50
test eax, eax
push 0
je 0x476f3f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004751f0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x476f25
cmp eax, 0x64
jg 0x476f13
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x476eb0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x476eb0
cmp eax, 0x64
jge 0x476eac
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x476eb0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004751f0
mov esi, eax
jmp 0x476eb0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x476f65
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4824b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4825d1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4825b5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x482507
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4824e5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x483019
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x483070
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x483070
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x483070
xor eax, eax
inc eax
jmp 0x483072
xor eax, eax
leave
ret 0x10
Function at 0x48309b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x483109
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4c3204
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x483100
cmp dword [ebp - 0xc], 4
jne 0x483100
cmp dword [ebp - 0x10], edi
je 0x483100
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4e6b70], edi
xor eax, eax
jmp 0x483148
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4e6b70], edi
jge 0x483143
lea eax, [ebp - 0x34]
push eax
mov dword [0x4e6b70], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x483143
cmp word [ebp - 0x14], 5
jb 0x483143
call fcn.00483076
test eax, eax
je 0x483143
emms
mov dword [0x4e6b70], 1
mov eax, dword [0x4e6b70]
pop edi
leave
ret

Function at 0x4a50ec
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a5124
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a3166
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a313e
jmp 0x4a5130
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a67de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a6820
call fcn.004ac56a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a6820
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a6817
xor eax, eax
jmp 0x4a6828
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a682e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4aca9a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4acac8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4acae6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aca00
jmp 0x4acae6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4acae6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aca00
test edi, edi
mov eax, edi
jne 0x4acad0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401200
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul edi
inc edx
bswap edi
imul edi
sub edx, 0x1a
imul eax
not esi
sbb eax, 0xe6
imul edi
not ebx
inc edx
neg ebx
neg edx
rcl eax, 0x7c
ror eax, 0x7f
dec ebx
ror edi, 0xb2
inc eax
neg ebx
sbb edi, 0x6b
imul edi
and esi, 0x9a
or ebx, 0x49
ror ebx, 0x50
or esi, 0x6d
sub esi, 0
not esi
rol edi, 0x2d
mov esi, 0xe
rcr edx, 0x16
not esi
inc esi
sbb eax, 0x9f
sbb edi, 0x7d
ror ebx, 0x23
inc ebx
not esi
imul ebx
rol ebx, 0x13
dec edx
dec edi
imul ebx
bswap esi
not eax
and ebx, 6
not eax
mov ebx, 0x73
or ebx, 0x68
bswap ebx
imul eax
xor ecx, ecx
xor edi, edi
add ebx, 0xbf
add edx, 0xf5
bswap edx
or edi, 0x4d
mov eax, 0x93
dec ebx
inc edx
not esi
ror eax, 0xb1
add eax, 0x2e
inc edx
inc eax
rcl esi, 0x6a
imul esi
and edx, 0xd
rcl esi, 0x83
ror eax, 0xf4
rcl esi, 0x65
dec eax
neg eax
ror edi, 0x24
and ebx, 0xe5
inc eax
add edi, 0x75
bswap edi
inc edi
mov esi, 0x94
imul eax
sbb ebx, 0x6e
inc edx
or edx, 0x86
sub ebx, 0x82
dec edx
rol edi, 0x59
mov eax, 0xf1
mov edx, 0xe0
not edi
bswap edx
rol ebx, 0x87
sub ebx, 0x5c
ror esi, 8
rol esi, 0x5d
inc ebx
imul edx
inc ebx
ror esi, 0x9f
not eax
inc esi
ror esi, 0x4e
rol edi, 0x38
mov ecx, dword [ebp + 0xc]
bswap edx
or esi, 0xa3
inc edi
and ebx, 0x95
not eax
imul eax
inc edi
dec eax
bswap edi
bswap eax
or esi, 0xe2
rcl eax, 0x26
ror esi, 0x3d
rcr esi, 0x98
sub esi, 0xbe
neg eax
add eax, 0xfa
and edi, 0xf1
not edx
ror edi, 0xc6
imul eax
add edi, 0x74
mov edi, 0xa4
inc edi
not ebx
dec edx
and edx, 0x25
bswap edi
or edx, 0x38
ror esi, 0x73
neg edx
rcl ebx, 0xe7
bswap ebx
sub edx, 0xe7
sbb edx, 0xa5
neg esi
sub edx, 0x75
sub eax, 0x96
inc edx
and edx, 0xe5
imul eax
rcr edx, 0x56
rol esi, 0x1e
rol edx, 7
sub esi, 0x74
and ebx, 0xcd
dec edi
dec edi
and esi, 0xd8
rol edi, 0x48
mov edi, dword [ebp + 8]
mov esi, esi
mov esi, esi
mov eax, ebx
not byte [edi]
xor ebx, ebx
mov esi, ebx
mov eax, ebx
mov eax, eax
xor eax, ebx
mov esi, esi
mov ebx, eax
mov esi, eax
xor ebx, eax
add byte [edi], 0x75
mov ebx, esi
mov eax, eax
mov ebx, eax
xor ebx, eax
xor eax, esi
mov esi, esi
xor eax, esi
mov esi, ebx
xor esi, esi
sub byte [edi], 0x25
xor ebx, eax
mov eax, ebx
xor ebx, esi
xor ebx, ebx
mov eax, eax
xor ebx, eax
xor esi, eax
xor esi, eax
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4013b9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401450
Capabilities:
Encode data using xor

Disassembly:
cli
les esp, [ebx - 0x32]
arpl word [edi], di
dec esi
dec edi
dec edi
cld
stc
clc
fisttp dword [edx - 0x26]
dec esp
xchg edi, eax
invalid

Function at 0x4064bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432fb8]
jne 0x4064c7
repz ret
jmp fcn.0040872c
Function at 0x4080ec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040653e
and dword [ebp - 4], 0
cmp dword [0x433ee4], 0
mov ebx, eax
jne 0x40819d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40824e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40824e
push eax
call fcn.004064cc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433ee4], eax
call esi
push eax
call fcn.004064cc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433ee8], eax
call esi
push eax
call fcn.004064cc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433eec], eax
call esi
push eax
call fcn.004064cc
pop ecx
mov dword [0x433ef4], eax
test eax, eax
je 0x40819d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004064cc
pop ecx
mov dword [0x433ef0], eax
mov eax, dword [0x433ef0]
cmp eax, ebx
je 0x4081f5
cmp dword [0x433ef4], ebx
je 0x4081f5
push eax
call fcn.00406547
push dword [0x433ef4]
mov esi, eax
call fcn.00406547
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081f5
test edi, edi
je 0x4081f5
call esi
test eax, eax
je 0x4081ec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081ec
test byte [ebp - 0xc], 1
jne 0x4081f5
or dword [ebp + 0x10], 0x200000
jmp 0x40822e
mov eax, dword [0x433ee8]
cmp eax, ebx
je 0x40822e
push eax
call fcn.00406547
pop ecx
test eax, eax
je 0x40822e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40822e
mov eax, dword [0x433eec]
cmp eax, ebx
je 0x40822e
push eax
call fcn.00406547
pop ecx
test eax, eax
je 0x40822e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433ee4]
call fcn.00406547
pop ecx
test eax, eax
je 0x40824e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408250
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401230
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg eax
not edi
sbb edi, 0xd9
sub eax, 0xde
and ebx, 0xc8
rcl esi, 0x2a
bswap edx
imul esi
not ebx
mov edx, 0x9b
neg esi
bswap eax
not eax
bswap edi
inc ebx
rcr esi, 0xfc
neg edx
ror esi, 0x6a
sub ebx, 0xeb
add edx, 0x4e
dec ebx
not edi
ror edi, 0x37
bswap ebx
imul edx
rcr esi, 0xcc
mov esi, 0x73
sbb edi, 0xdd
sub ebx, 0x81
not edi
not eax
or eax, 0x14
rol esi, 0xfc
inc eax
dec eax
not esi
mov eax, 0x7d
imul ebx
inc esi
dec edx
rcr edx, 0x9b
bswap edi
add eax, 0x11
and edi, 0x1d
ror edx, 0x1f
imul edi
inc esi
and edx, 0xd8
rol eax, 0xb4
inc eax
xor ecx, ecx
xor edi, edi
or edi, 0xc6
not ebx
add ebx, 0xa1
not edx
neg esi
and esi, 5
dec eax
ror edi, 0x3f
neg esi
dec esi
dec edi
bswap edx
imul edi
imul ebx
sbb esi, 0xb1
bswap edi
imul eax
imul edx
mov ebx, 0xc3
rol eax, 0x53
not edi
neg esi
rol edi, 0x32
rol edx, 0xd6
dec edx
and eax, 0xf0
sbb edi, 0x14
imul esi
neg eax
dec eax
and ebx, 0x2c
sbb ebx, 0x59
imul edi
imul eax
bswap esi
rcr eax, 0x40
ror ebx, 0x56
rcr eax, 0xda
inc eax
rcr eax, 0x6d
or edx, 0x1b
not edx
sbb eax, 0x6e
imul edx
dec edx
bswap eax
neg ebx
rcl eax, 0xfa
bswap ebx
dec eax
mov ecx, dword [ebp + 0xc]
add edx, 0xbb
dec eax
or edi, 0x3f
add eax, 0x25
sbb ebx, 0xab
sbb eax, 0x71
imul edx
not eax
mov esi, 0x9a
inc ebx
inc esi
dec eax
neg eax
imul eax
and edi, 0x66
dec eax
bswap edi
rcr edi, 0x46
not esi
imul eax
bswap edi
not edx
not edi
sbb ebx, 0xd5
add ebx, 0xd4
inc edx
mov ebx, 0xec
neg eax
not edi
not esi
sub eax, 0xcb
or eax, 0xc2
mov ebx, 0xae
bswap esi
dec esi
inc edi
neg edi
rcl edi, 0x3b
dec esi
imul eax
not edx
rcr ebx, 0x3c
not edx
rol esi, 0x4f
add edx, 0x30
inc ebx
ror ebx, 0x83
ror eax, 0x23
add edx, 0xa2
rcr edi, 0xec
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ebx
mov ebx, eax
not byte [edi]
xor ebx, esi
xor esi, eax
mov ebx, esi
xor esi, eax
mov esi, ebx
xor ebx, ebx
mov eax, eax
xor esi, esi
xor esi, ebx
add byte [edi], 0x79
xor eax, ebx
mov eax, esi
xor ebx, eax
mov ebx, esi
xor ebx, ebx
xor ebx, ebx
xor eax, esi
mov ebx, esi
mov eax, esi
sub byte [edi], 0x30
mov eax, esi
mov esi, eax
xor ebx, ebx
mov eax, eax
mov esi, ebx
xor eax, eax
mov esi, eax
mov eax, esi
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4013d9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4063fd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463fb8]
jne 0x406407
repz ret
jmp fcn.0040866c
Function at 0x40802c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040647e
and dword [ebp - 4], 0
cmp dword [0x464ee4], 0
mov ebx, eax
jne 0x4080dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40818e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40818e
push eax
call fcn.0040640c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x464ee4], eax
call esi
push eax
call fcn.0040640c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x464ee8], eax
call esi
push eax
call fcn.0040640c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x464eec], eax
call esi
push eax
call fcn.0040640c
pop ecx
mov dword [0x464ef4], eax
test eax, eax
je 0x4080dd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040640c
pop ecx
mov dword [0x464ef0], eax
mov eax, dword [0x464ef0]
cmp eax, ebx
je 0x408135
cmp dword [0x464ef4], ebx
je 0x408135
push eax
call fcn.00406487
push dword [0x464ef4]
mov esi, eax
call fcn.00406487
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408135
test edi, edi
je 0x408135
call esi
test eax, eax
je 0x40812c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40812c
test byte [ebp - 0xc], 1
jne 0x408135
or dword [ebp + 0x10], 0x200000
jmp 0x40816e
mov eax, dword [0x464ee8]
cmp eax, ebx
je 0x40816e
push eax
call fcn.00406487
pop ecx
test eax, eax
je 0x40816e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40816e
mov eax, dword [0x464eec]
cmp eax, ebx
je 0x40816e
push eax
call fcn.00406487
pop ecx
test eax, eax
je 0x40816e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x464ee4]
call fcn.00406487
pop ecx
test eax, eax
je 0x40818e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408190
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411180
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48be9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047e152
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x411202
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047b77a
mov eax, dword [eax]
push 0x585220
push eax
call fcn.0046d964
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047e3dd
test bl, bl
je 0x411202
push 0x585220
lea ecx, [esp + 0xc]
call fcn.0047e7b9
push 0x588d9c
lea ecx, [esp + 0xc]
call fcn.0047e7b9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41123e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047e3dd
jmp 0x411309
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4112c2
lea edx, [esp + 0x7c]
push 0x588d98
push edx
call fcn.0046d964
add esp, 8
test eax, eax
je 0x4112c2
lea eax, [esp + 0x7c]
push 0x588d94
push eax
call fcn.0046d964
add esp, 8
test eax, eax
je 0x4112c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x411252
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047e3dd
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x411b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x411b62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc