joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40102c
Capabilities:
Encode data using xor

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 0
push 0x40102c
push 0
push 0x3e8
push dword [section..data]
call sub.user32.dll_DialogBoxParamA
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x4010cb
push 0
call fcn.00401250
mov dword [0x40417e], eax
push 0
call fcn.00401250
mov dword [0x40416e], eax
push 0
call fcn.00401250
mov dword [0x404172], eax
push 0
call fcn.00401250
mov dword [0x404176], eax
push 0
call fcn.00401250
mov dword [0x40417a], eax
push dword [0x40416e]
push 0x10
push str.80FAA96126C399C7E83E89CA1B40CCB992A1BBA4D6C7CC2AA0B8B765630E241388E65E3FB7227E3098CB6D9E390B75E15C40193B0B
call fcn.004013f3
push dword [0x404172]
push 0x10
push str.13286317F7711D35FAEBEEF5BDC1308755996ADBBE50205343EDA5B71276B12E3C028E5307519CAB52AB00581D2E2856DEF9F53B1BF
call fcn.004013f3
push dword [0x40417a]
push 0x10
push str.140AFBB597E2943B38CBBC5D80E26A81C152DA4BE47C1E163E1C633874D0CD2C3FC67457AF83AEC05956D45A378FE63591F3B8B635B
call fcn.004013f3
push dword [0x404176]
push dword [0x404172]
push dword [0x40416e]
call fcn.00401c74
jmp 0x401216
cmp eax, 0x111
jne 0x4011c5
mov eax, dword [ebp + 0x10]
mov edx, eax
shr edx, 0x10
and eax, 0xffff
or edx, edx
jne 0x401216
cmp eax, 0x3ea
jne 0x4011c3
pushal
push 0x64
push 0x40418d
push 0x3ec
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
cmp eax, 5
jae 0x401127
push str.Wrong_name_lenght.Must_be_over_4_chars
push 0x3ee
push dword [ebp + 8]
call sub.user32.dll_SetDlgItemTextA
jmp 0x4011c2
xor esi, esi
lea edi, [0x40418d]
mov al, byte [edi]
test al, al
je 0x401147
mov ecx, edi
movsx edx, al
mov al, byte [ecx + 1]
xor edx, 0x14
add esi, edx
inc ecx
test al, al
jne 0x401137
add esi, 0x783e
push esi
push 0x40418a
push 0x404182
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x40417e]
push 0xa
push 0x404182
call fcn.004013f3
push dword [0x40417e]
push dword [0x404176]
push dword [0x40417a]
push dword [0x40417e]
call fcn.00402204
push 0x4041f1
push 0xa
push dword [0x40417e]
call fcn.004016d5
push 0x4041f1
push 0x3ee
push dword [ebp + 8]
call sub.user32.dll_SetDlgItemTextA
push 0x100
push 0x4041f1
call sub.kernel32.dll_RtlZeroMemory
popal
jmp 0x401216
cmp eax, 0x10
jne 0x40120d
push dword [0x40417e]
call fcn.0040127d
push dword [0x40416e]
call fcn.0040127d
push dword [0x404172]
call fcn.0040127d
push dword [0x404176]
call fcn.0040127d
push dword [0x40417a]
call fcn.0040127d
push 0
push dword [ebp + 8]
call sub.user32.dll_EndDialog
jmp 0x401216
mov eax, 0
leave
ret 0x10
mov eax, 1
leave
ret 0x10
Function at 0x409c84
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x4263cf
call fcn.0041a46a
push dword [ebp + 8]
call fcn.0040b95b
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
cmp edi, 1
je 0x409cb5
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x409cb5
mov al, 1
jmp 0x409d04
test edi, edi
je 0x409d02
lea ecx, [ebp - 0x18]
call fcn.00408f97
and dword [ebp - 4], 0
cmp edi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040bd59
test al, al
je 0x409cf9
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.004094ff
test esi, esi
pop ecx
setne al
jmp 0x409d04
push dword [ebp - 0x18]
call fcn.004094ff
pop ecx
xor al, al
call fcn.0041a509
ret 8

Function at 0x409d8b
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x4263cf
call fcn.0041a46a
push dword [ebp + 8]
call fcn.0040b95b
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
cmp edi, 1
je 0x409dc8
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x409dbb
mov al, 1
jmp 0x409e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409e14
test edi, edi
je 0x409e14
lea ecx, [ebp - 0x18]
call fcn.00408f97
and dword [ebp - 4], 0
cmp edi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040bd59
test al, al
je 0x409e0b
push 0
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.004094ff
test esi, esi
pop ecx
setne al
jmp 0x409e16
push dword [ebp - 0x18]
call fcn.004094ff
pop ecx
xor al, al
call fcn.0041a509
ret 4

Function at 0x409f6a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x431cb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.00409033
mov ecx, dword [ebp - 4]
dec edi
mov eax, 0x103
cmp eax, edi
sbb eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.0041a45b
leave
ret 4
Function at 0x40a1c9
Capabilities:
Create directory

Disassembly:
push 0x7c
mov eax, 0x4260be
call fcn.0041a46a
push dword [ebp + 8]
call fcn.0040b95b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 0xb7
cmp esi, 1
je 0x40a212
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40a208
mov al, 1
call fcn.0041a509
ret 4
call edi
cmp eax, ebx
je 0x40a2b4
test esi, esi
je 0x40a2b4
lea ecx, [ebp - 0x18]
call fcn.00408f97
and dword [ebp - 4], 0
cmp esi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040bd59
test al, al
je 0x40a2a7
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40a25e
mov bl, 1
push dword [ebp - 0x18]
call fcn.004094ff
pop ecx
mov al, bl
jmp 0x40a200
call edi
cmp eax, ebx
je 0x40a268
xor bl, bl
jmp 0x40a251
lea ecx, [ebp - 0x50]
call fcn.0040aa99
lea ecx, [ebp - 0x28]
call fcn.00408f97
push dword [ebp - 0x18]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0040ab93
push dword [ebp - 0x28]
test al, al
jne 0x40a296
call fcn.004094ff
pop ecx
jmp 0x40a264
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
call fcn.004094ff
pop ecx
jmp 0x40a251
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.004094ff
pop ecx
call edi
cmp eax, ebx
je 0x40a2c1
xor al, al
jmp 0x40a200
lea ecx, [ebp - 0x88]
call fcn.0040aa99
lea ecx, [ebp - 0x60]
call fcn.00408f97
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 2
call fcn.0040ab93
test al, al
jne 0x40a2f7
xor bl, bl
push dword [ebp - 0x60]
jmp 0x40a254
mov ebx, dword [ebp - 0x68]
shr ebx, 4
and bl, 1
jmp 0x40a2ef

Function at 0x40aabc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xc
mov eax, 0x4263cf
call fcn.0041a46a
push dword [ebp + 8]
call fcn.0040b95b
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 1
je 0x40aae7
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
jne 0x40ab2e
test edi, edi
je 0x40ab2b
lea ecx, [ebp - 0x18]
call fcn.00408f97
and dword [ebp - 4], 0
cmp edi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040bd59
push dword [ebp - 0x18]
test al, al
je 0x40ab25
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.004094ff
pop ecx
mov eax, esi
jmp 0x40ab2e
call fcn.004094ff
pop ecx
or eax, 0xffffffff
call fcn.0041a509
ret 4

Function at 0x40b00e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b034
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40b034
xor al, al
jmp 0x40b054
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0041c530
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40b78a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x431cb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
and dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.00409033
mov ecx, dword [ebp - 4]
dec edi
mov eax, 0x103
cmp eax, edi
sbb eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.0041a45b
leave
ret

Function at 0x411564
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
add ecx, 0x10
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
test eax, eax
jbe 0x41159b
mov ebx, dword [edx]
mov dword [ecx + esi*4], ebx
inc esi
add edx, 4
cmp esi, eax
jb 0x41158e
cmp esi, edi
jae 0x41167e
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 - 4]
mov dword [ebp - 8], eax
test edx, edx
jne 0x411614
mov eax, edi
mov edx, 0xff
and eax, edx
movzx eax, byte [eax + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, edi
shr edi, 8
and edi, edx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [edi + str.cw]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x428f70]
shl eax, 8
or eax, ebx
xor edx, edi
shl eax, 8
or eax, edx
mov edi, eax
jmp 0x411666
cmp dword [ebp + 8], 6
jbe 0x411666
cmp edx, 4
jne 0x411666
mov edx, edi
shr edx, 0x10
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
mov eax, 0xff
and edx, eax
movzx edx, byte [edx + str.cw]
shl ebx, 8
or edx, ebx
mov ebx, edi
shr ebx, 8
and ebx, eax
movzx ebx, byte [ebx + str.cw]
shl edx, 8
and edi, eax
movzx eax, byte [edi + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov edi, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4115ad
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412bc9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
and esi, 7
cmp eax, 5
jae 0x412be9
xor eax, eax
jmp 0x412d02
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add eax, ebx
push edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 4]
lea edx, [edi + ebx]
jmp 0x412c0b
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x412c10
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x412c02
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov dword [ebp - 4], eax
cmp edx, dword [ebp + 0xc]
jae 0x412ceb
cmp ecx, 2
jbe 0x412c6b
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x412c89
movzx eax, byte [edx + 3]
mov edi, dword [ebp + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 5
add edi, ecx
cmp dword [ebp + 0x18], 0
je 0x412c96
add eax, edi
jmp 0x412c98
shr esi, cl
test esi, esi
je 0x412c2d
cmp esi, 4
ja 0x412c89
cmp esi, 3
je 0x412c89
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edx + 1]
inc eax
test al, 0xfe
jne 0x412c2d
or esi, 8
shr esi, 1
inc dword [ebp - 4]
jmp 0x412bfa
sub eax, edi
test esi, esi
je 0x412cc9
and esi, 6
shl esi, 2
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x412cc4
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x18], 0
je 0x412cc2
add eax, edi
jmp 0x412cc4
sub eax, edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x412bfa
push 2
pop eax
shr esi, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x14]
sbb eax, eax
not eax
and eax, esi
pop edi
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop ebx
pop esi
leave
ret 0x14
Function at 0x41318f
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x368]
sub esp, 0x3e8
mov eax, dword [0x431cb0]
xor eax, ebp
mov dword [ebp + 0x364], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4131cb
cmp dword [ebp - 0x7c], 6
jne 0x4131cb
cmp dword [ebp - 0x78], 0
je 0x4131f5
push str.SetDefaultDllDirectories
push 0x4289c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4131f5
push 0xc00
call eax
test eax, eax
jne 0x413289
push 0x106
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x413289
cmp eax, 0x104
ja 0x413289
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 + 0x92], 0x5c
je 0x413236
push 0x5c
pop ecx
mov word [ebp + eax*2 + 0x94], cx
inc eax
cmp byte [0x428fc0], 0
push esi
mov esi, 0x428fc0
je 0x413288
push edi
lea edi, [ebp + eax*2 + 0x94]
mov ecx, edi
mov al, byte [esi]
movsx dx, al
inc esi
mov word [ecx], dx
inc ecx
inc ecx
test al, al
jne 0x41324f
push 0x429010
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x41324d
pop edi
pop esi
mov ecx, dword [ebp + 0x364]
xor ecx, ebp
call fcn.0041a45b
add ebp, 0x368
leave
ret

Function at 0x4159dc
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4

Function at 0x415d1b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.0041c9a9
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.00415cd6
pop ebp
ret 0xc
Function at 0x418396
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f8c]
mov eax, 0x200c
call fcn.0041cdd0
mov eax, dword [0x431cb0]
xor eax, ebp
mov dword [ebp + 0x1f88], eax
push esi
push edi
mov edi, 0x2000
push edi
xor esi, esi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.0041c050
add esp, 0xc
push edi
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
lea eax, [ebp - 0x80]
push eax
push 4
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1f88]
pop edi
xor ecx, ebp
pop esi
call fcn.0041a45b
add ebp, 0x1f8c
leave
ret

Function at 0x41851f
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x431cb0]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.0041c050
add esp, 0xc
push 0x208
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push edi
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push esi
push eax
call fcn.0041c050
push str.Applications_
mov edi, 0x104
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.0041ce78
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.0041cda4
inc eax
inc eax
push eax
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.0041cdfb
add esp, 0x2c
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp + 0x190]
push eax
push SysReAllocStringLen
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, eax
push 2
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x80]
push eax
push 1
push esi
push str.IsHostApp
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x398]
pop edi
xor ecx, ebp
pop esi
call fcn.0041a45b
add ebp, 0x39c
leave
ret
Function at 0x41a45b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431cb0]
jne 0x41a465
repz ret
jmp fcn.0041ea5c

Function at 0x4212d9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d4b4
and dword [ebp - 4], 0
cmp dword [0x4359f4], 0
mov ebx, eax
jne 0x42138a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42143b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42143b
push eax
call fcn.0041d442
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4359f4], eax
call esi
push eax
call fcn.0041d442
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4359f8], eax
call esi
push eax
call fcn.0041d442
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4359fc], eax
call esi
push eax
call fcn.0041d442
pop ecx
mov dword [0x435a04], eax
test eax, eax
je 0x42138a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d442
pop ecx
mov dword [0x435a00], eax
mov eax, dword [0x435a00]
cmp eax, ebx
je 0x4213e2
cmp dword [0x435a04], ebx
je 0x4213e2
push eax
call fcn.0041d4bd
push dword [0x435a04]
mov esi, eax
call fcn.0041d4bd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4213e2
test edi, edi
je 0x4213e2
call esi
test eax, eax
je 0x4213d9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4213d9
test byte [ebp - 0xc], 1
jne 0x4213e2
or dword [ebp + 0x10], 0x200000
jmp 0x42141b
mov eax, dword [0x4359f8]
cmp eax, ebx
je 0x42141b
push eax
call fcn.0041d4bd
pop ecx
test eax, eax
je 0x42141b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42141b
mov eax, dword [0x4359fc]
cmp eax, ebx
je 0x42141b
push eax
call fcn.0041d4bd
pop ecx
test eax, eax
je 0x42141b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4359f4]
call fcn.0041d4bd
pop ecx
test eax, eax
je 0x42143b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42143d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026d0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026de
call dword [0x448024]
or eax, eax
je 0x4026df
ret
mov al, 1
jmp fcn.0040275c

Function at 0x4026e8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026f6
call dword [0x448028]
or eax, eax
jne 0x4026f7
ret
mov al, 2
jmp fcn.0040275c

Function at 0x402700
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402738
test edx, edx
je 0x402722
push eax
mov eax, ecx
call dword [0x44802c]
pop ecx
or eax, eax
je 0x402731
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040275c
mov dword [eax], edx
mov eax, ecx
call dword [0x448028]
or eax, eax
jne 0x40271b
ret
mov al, 1
jmp fcn.0040275c
test edx, edx
je 0x40274c
push eax
mov eax, edx
call dword [0x448024]
pop ecx
or eax, eax
je 0x402731
mov dword [ecx], eax
ret

Function at 0x40275c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x44b004]
test ecx, ecx
je 0x40276c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402785]
jns 0x402780
call fcn.004062a4
mov eax, dword [eax + 4]
jmp fcn.00403a14

Function at 0x4027a0
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.004062a4
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4027b5
ret
xor eax, eax
jmp fcn.0040275c

Function at 0x40290c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40293b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b08
jmp 0x402959
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402834
mov edi, eax
test ebx, ebx
je 0x402959
cmp dword [esi], 0
je 0x402959
dec ebx
jmp 0x402942
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ca8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c88
xor eax, eax
push ebp
push 0x402c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f28
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f42
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f42
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f2e
mov al, 0xa
jmp fcn.0040275c
ret