joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d77c0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4d7820
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4d7820
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4d7820
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4d7820
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4d7830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4dab60
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4dac03
test eax, eax
jbe 0x4dac03
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4dac03
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4dabae
xor esi, esi
jmp 0x4dabb4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4dabdf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004532c0
add esi, eax
push esi
mov ebx, esi
call fcn.004532c0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4dabc0
pop ebp
test edi, edi
pop edi
jne 0x4dac03
test ebx, ebx
je 0x4dac03
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00505730
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4dad25
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4dae3d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4dae3d
mov eax, dword [esi + 0x3c]
push eax
call fcn.005245e6
mov esi, eax
test esi, esi
je 0x4dae3d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4dae3d
mov ecx, esi
call fcn.004dacb0
cmp edi, eax
jge 0x4dae3d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4dadc3
mov dword [esp + 0x34], 1
jmp 0x4dae1e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4dae3d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004d9500
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4e8120
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x13ab7f8]
xor edx, edx
cmp eax, edx
jne 0x4e8146
xor eax, eax
mov byte [eax + 0x13ab6f8], al
inc eax
cmp eax, 0x100
jl 0x4e812e
mov dword [0x13ab7f8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x13ab6f8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4e81d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4e81aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4e8178
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4e8250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4e82a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4e828a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eec50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x536b4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004ef570
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1259e3c
call fcn.005227ff
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4eece3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005227ff
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4eecdc
push 0
mov ecx, eax
call fcn.004e5d50
mov dword [esi + 0xc], eax
jmp 0x4eece5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4eece5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x524f8a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x524fc2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00522f65
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00522f3d
jmp 0x524fce
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x526788
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5267ca
call fcn.0052ccdd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5267ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5267c1
xor eax, eax
jmp 0x5267d2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005267d8
pop edi
pop esi
pop ebx
ret 4

Function at 0x52d20d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x52d23b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x52d259
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0052d173
jmp 0x52d259
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52d259
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0052d173
test edi, edi
mov eax, edi
jne 0x52d243
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x37ea10be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xf816fac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407fb0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x407fbd
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x407fcf
pop esi
ret
cmp ecx, 1
jne 0x407fdd
cmp byte [esi], 0x5c
jne 0x407fdd
xor eax, eax
pop esi
ret
push esi
call fcn.00407d60
add esp, 4
test eax, eax
je 0x407ff1
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7b8075ac
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7560c60
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100145fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001460d
pop dword [ebp - 8]
mov eax, 0xaa384ed0
sub eax, 0x9a3708c3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2d29cf63
add dword [ebp - 0x18], 0x212875e8
mov dword [ebp - 0x14], 0x19c08b16
sub dword [ebp - 0x14], 0xe78d3ed1
mov dword [ebp - 0x10], 0x9bceabd9
add dword [ebp - 0x10], 0xb07d9855
mov dword [ebp - 0xc], 0x10bcf3cb
sub dword [ebp - 0xc], 0x10bcf3cb
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3c4a956d
add eax, 0xd3bafb9f
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x488ddd03
add dword [ebp - 0x18], 0x2be48c53
mov dword [ebp - 0x14], 0xa51c21ab
add dword [ebp - 0x14], 0x9c503fca
mov dword [ebp - 0x10], 0x6c7e6e25
add dword [ebp - 0x10], 0xf6f0fe47
mov dword [ebp - 0xc], 0x548c3603
add dword [ebp - 0xc], 0xab73c9fd
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xa7618d29
sub eax, 0x975bfce9
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x60830
push 0
call eax
mov ecx, 0x118190d6
add ecx, 0xee7ec2f2
mov edx, eax
mov ebx, 0x10069400
add ebx, dword [ebp - 8]
mov esi, 0x54d08f74
sub esi, 0x7d6d9116
xor dword [ebp - 4], 0xa4ec87ee
mov edi, dword [ebx]
mov dword [ebp - 4], 0x6a8b7dbe
add edi, esi
mov dword [ebp - 4], 0xad114d86
mov dword [edx], edi
xor dword [ebp - 4], ecx
add edx, 4
add ebx, 0xe8a3e3bb
sub ebx, 0xe8a3e3b7
loop 0x10014729
add eax, 0xf7d87ed1
add eax, 0x828c322
mov ebx, eax
add eax, 0x332e6429
sub eax, 0x332e6424
mov ecx, 0xf9757e2c
sub ecx, 0xe9757e2c
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403fbd
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x436d75
call fcn.00424761
lea eax, [ebp - 0x10]
push eax
call fcn.0041b307
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
lea eax, [ebp - 0x14]
push str._shm
push eax
lea esi, [ebp - 0x10]
call fcn.0040bb4c
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [eax]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004185d3
lea eax, [ebp - 0x14]
push str._wal
push eax
call fcn.0040bb4c
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004185d3
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004185d3
call fcn.00424839
ret

Function at 0x404590
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x434e44
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44cd60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.0041b8cd
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x4045ec
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x4045ee
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x404694
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x404655
mov eax, dword [edi]
push esi
push eax
call fcn.00422fe5
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x404652
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.00422c00
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40467b
cmp dword [esp + 0x40], esi
je 0x404694
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x404694
mov eax, dword [esi]
push ebx
push eax
call fcn.00422fe5
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40ab8c
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x4367ca
call fcn.00424761
lea eax, [ebp - 0x10]
push eax
call fcn.0040e818
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea esi, [ebp - 0x10]
call fcn.0040b1be
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push 1
push str.InstallDir
mov ebx, str.SoftwareAdvancedSystemRepairPro
push ebx
push SysReAllocString
call edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
call fcn.0040b1be
push eax
push 1
push str.InstallDir
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004185d3
call fcn.00424839
ret

Function at 0x40b874
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x44cd60]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 0x14
mov eax, 0x436843
call fcn.00424761
xor ebx, ebx
push 0x228
lea eax, [ebp + 4]
push ebx
push eax
mov dword [ebp], ebx
call fcn.00422c00
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
je 0x40b92e
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40b92a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x24]
call fcn.0040e818
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
call fcn.00410eea
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jl 0x40b915
push str.advancedsystemrepairpro.exe
push eax
call fcn.004238b3
pop ecx
pop ecx
cmp eax, ebx
je 0x40b915
sub eax, dword [ebp - 0x10]
sar eax, 1
cmp eax, 0xffffffff
jne 0x40b962
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004185d3
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b8da
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x40b93d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.0040cd81
add ebp, 0x230
leave
ret
push dword [ebp + 8]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x40b9be
push 0x440b84
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x40b9a7
lea ecx, [ebp - 0x18]
push ecx
push 0x1388
push 1
push ebx
push ebx
push 0x864
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40b9be
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x40b9cf
push esi
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004185d3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], ebx
je 0x40b9e8
push dword [ebp - 0x14]
call edi
mov al, 1
jmp 0x40b93f
Function at 0x40ba9f
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x436c8f
call fcn.00424761
mov edi, dword [ebp + 8]
push edi
call fcn.0040caae
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00411cb7
pop ecx
mov byte [ebp - 4], 1
call fcn.0041b696
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004185d3
push dword [edi]
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40baea
mov byte [ebp - 0xd], 1
mov eax, dword [edi]
push ebx
push ebx
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40bb0b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
je 0x40bb3e
push dword [edi]
call fcn.00410c48
push ebx
call fcn.00422a8e
pop ecx
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x441c68
call fcn.0040e818
mov byte [ebp - 4], 2
push edi
mov byte [ebp - 4], bl
call fcn.0040ff32
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00424839
ret 4

Function at 0x40c404
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x435177
call fcn.00424761
mov dword [ebp - 4], 1
xor ebx, ebx
xor eax, eax
cmp byte [ebp + 0x14], bl
push ebx
sete al
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov dword [ebp - 0x10], ebx
dec eax
and eax, 0x100
inc eax
inc eax
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x40c466
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.004185d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004185d3
call fcn.00424839
ret
Function at 0x40c51c
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x436ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x44cd60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
inc ebx
mov dword [esp + 0x10], esi
cmp dword [ebp + 0xc], esi
je 0x40c55b
mov ecx, dword [ebp + 0xc]
jmp 0x40c570
lea eax, [esp + 0x18]
push eax
call fcn.004169b2
pop ecx
mov dword [esp + 0x30], esi
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x14]
push eax
call fcn.0040e818
mov dword [esp + 0x30], 2
test byte [esp + 0x10], bl
je 0x40c596
and dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x18]
call fcn.004185d3
cmp byte [ebp + 8], 0
je 0x40c641
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.0040265c
pop ecx
pop ecx
test al, al
jne 0x40c64c
lea eax, [esp + 0x20]
push eax
mov ecx, 0x440f74
call fcn.0040e818
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
mov esi, eax
call fcn.00408b15
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x20]
push str.___minimize
push ecx
mov esi, eax
call fcn.0040bb4c
add esp, 0x10
mov byte [esp + 0x30], 6
lea ecx, [esp + 0x1c]
call fcn.004185d3
mov byte [esp + 0x30], 7
lea ecx, [esp + 0x20]
call fcn.004185d3
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push ebx
push 0x440b84
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.004185d3
jmp 0x40c66e
push dword [ebp + 0xc]
push esi
call fcn.0040265c
pop ecx
pop ecx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, 0x440b84
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push esi
push SysReAllocString
call ebx
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004185d3
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cd81
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44cd60]
jne 0x40cd8b
repz ret
jmp fcn.004278b0