joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a0088
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6a010c
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6a00f4
mov ebx, esi
test ebx, ebx
je 0x6a00ba
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6a0128
call fcn.0040b4c8
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6a00f6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0113
lea eax, [ebp - 8]
call fcn.0040a1c8
ret

Function at 0x6a6520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x6a652a
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x6a65e0
push 0x6a6614
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x6a65c9
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6a65c9
test al, 0x10
je 0x6a657a
mov ebp, 0x2000000
jmp 0x6a657c
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x6a65c9
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x6a65c9
cmp ebx, 0xff0
jge 0x6a65c9
mov edx, edi
mov eax, esp
call fcn.006a6438
jmp 0x6a65d2
mov eax, edi
mov edx, esi
call fcn.0040a5a8
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6a6630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6a66c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x6a6697
cmp ebx, 0x104
jge 0x6a6697
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b318
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.006a6520
jmp 0x6a66a8
mov eax, 0x6a66dc
call fcn.0060d278
mov eax, esi
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a66c8
lea eax, [ebp - 0x20c]
call fcn.0040a1c8
ret
Function at 0x6a6704
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a6853
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.006a6520
lea eax, [ebp - 8]
call fcn.006a6630
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407760
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x6a6860
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040b278
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.0040b278
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040b278
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x6a67af
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x6a67a5
call fcn.00428ff4
mov eax, 0x6a6878
call fcn.0060d1c0
cmp dword [ebp - 0x10], 0
jne 0x6a67bf
mov eax, 0x6a68a4
call fcn.0060d064
xor edx, edx
push ebp
push 0x6a6831
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.006a622c
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6a67cd
cmp eax, 0xffffffff
jne 0x6a67fa
mov eax, 0x6a68f8
call fcn.0060d1c0
call fcn.006a622c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x6a681a
mov eax, 0x6a6938
call fcn.0060d1c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a6838
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x6a6960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6a6a2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x6a6000]
call fcn.006a6a58
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a6a08
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x6a6a48
call fcn.00424510
mov edx, dword [ebp - 8]
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
call fcn.005b8268
call fcn.006a622c
call sub.user32.dll_GetFocus
mov edx, dword [0x6ceec4]
mov edx, dword [edx]
cmp eax, dword [edx + 0x188]
jne 0x6a69eb
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x6a69f2
call sub.user32.dll_WaitMessage
jmp 0x6a69c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a6a0f
mov eax, dword [ebp - 4]
call fcn.00408444
ret
Function at 0x6acee8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6acef0
push ecx
push ebx
xor eax, eax
push ebp
push 0x6ad03e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0060db4c
mov edx, dword [ebp - 0x10]
mov eax, 0x6d7530
call fcn.0040a5a8
lea eax, [ebp - 0x14]
mov ecx, dword [0x6d7530]
mov edx, 0x6ad058
call fcn.0040b4c8
mov eax, dword [ebp - 0x14]
call fcn.0061674c
mov eax, dword [0x6cefdc]
cmp byte [eax], 0
je 0x6acf4b
mov eax, dword [0x6d7530]
call fcn.00615e58
lea edx, [ebp - 0x18]
mov eax, dword [0x6d7530]
call fcn.005c4ebc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x6ad0a0
call fcn.0040b4c8
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x6acfe5
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.005cd844
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00423044
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005c86b0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov ax, 0x81
call fcn.005cd814
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41baa4]
call fcn.00429020
call fcn.004098c4
lea eax, [ebp - 8]
call fcn.00625b68
cmp dword [ebp - 8], 0
je 0x6ad016
lea eax, [ebp - 0xc]
mov ecx, 0x6ad0bc
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006ace90
mov eax, dword [ebp - 0xc]
call fcn.00625bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad045
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040a228
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040a228
ret

Function at 0x6afbb4
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x6d7825], 1
call fcn.0060fcf4
test al, al
jne 0x6afc06
push 5
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6ceed8]
mov eax, dword [eax + 0x15c]
mov cl, 2
xor edx, edx
call fcn.006af8c4
ret

Function at 0x6b3568
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x6b358d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b53c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x6b53ec
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x6b53f5
call fcn.006b4000
mov eax, 0xa
call fcn.005c8ccc
call fcn.006b4000
call fcn.006b538c
test al, al
jne 0x6b53ca
pop ebx
ret

Function at 0x6b5a78
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x6d77dd], 0
push 0x6b5c04
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x6b5c20
push ebx
call fcn.00414030
mov esi, eax
test esi, esi
je 0x6b5b20
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x6b5b20
cmp word [esp], 0
je 0x6b5b20
mov byte [0x6d77dd], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x6b5ae4
sub ax, 0xb4
je 0x6b5af0
sub ax, 0x8464
je 0x6b5afc
sub ax, 0x2400
je 0x6b5b08
jmp 0x6b5b14
mov byte [0x6ce73d], 1
jmp 0x6b5bbc
mov byte [0x6ce73d], 3
jmp 0x6b5bbc
mov byte [0x6ce73d], 2
jmp 0x6b5bbc
mov byte [0x6ce73d], 4
jmp 0x6b5bbc
mov byte [0x6ce73d], 0
jmp 0x6b5bbc
push 0x6b5c40
push ebx
call fcn.00414030
test eax, eax
je 0x6b5b68
lea edx, [esp + 8]
push edx
call eax
push 0x6b5c68
push ebx
call fcn.00414030
mov esi, eax
test esi, esi
je 0x6b5b72
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x6b5b72
cmp dword [esp + 4], 0
je 0x6b5b72
mov byte [0x6d77dd], 1
jmp 0x6b5b72
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x6b5b91
sub ax, 5
je 0x6b5b9a
sub ax, 3
je 0x6b5ba3
sub ax, 3
je 0x6b5bac
jmp 0x6b5bb5
mov byte [0x6ce73d], 1
jmp 0x6b5bbc
mov byte [0x6ce73d], 3
jmp 0x6b5bbc
mov byte [0x6ce73d], 2
jmp 0x6b5bbc
mov byte [0x6ce73d], 4
jmp 0x6b5bbc
mov byte [0x6ce73d], 0
cmp byte [0x6d77dd], 0
je 0x6b5bfd
call fcn.0060c2a8
test al, al
je 0x6b5bf6
push 0x6b5c88
push ebx
call fcn.00414030
test eax, eax
je 0x6b5bf6
push 0x6b5cbc
push 0x6b5cdc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
test eax, eax
jne 0x6b5bfd
mov byte [0x6d77dd], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x6b5cf8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x6b5d68
mov edx, 0x80000002
xor eax, eax
call fcn.005c7a60
test eax, eax
jne 0x6b5d61
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x6b5dbc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6b5d58
cmp dword [ebp - 0xc], 4
jne 0x6b5d58
cmp dword [ebp - 8], 4
jne 0x6b5d58
movzx eax, word [ebp - 0x10]
mov word [0x6d77f4], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x393d4ec8
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x281820a2
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040c4a7
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408ca3
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040c42d
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040c44d
inc esi
cmp esi, 0xc
jl 0x40c4ff
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x410550]
test byte [eax + 0x28], 2
movzx eax, byte [0x4205bf]
jne 0x40c53a
movzx eax, byte [0x4205c7]
movzx ecx, cx
cmp ecx, eax
je 0x40c546
or eax, 0xffffffff
jmp 0x40c58b
mov ecx, dword [0x420568]
mov eax, ecx
cdq
cmp edx, dword [0x40f924]
push edi
jl 0x40c568
mov edx, dword [0x40f920]
jg 0x40c564
cmp eax, edx
jbe 0x40c568
mov edi, edx
jmp 0x40c56a
mov edi, ecx
mov esi, dword [0x420560]
jmp 0x40c584
dec edi
call fcn.0040c42d
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040c44d
inc esi
test edi, edi
jne 0x40c572
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4050d8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x405197
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004090fc
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x405181
cmp dword [ebp - 8], 0
jbe 0x40517f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004027c0
mov ebx, eax
xor esi, esi
jmp 0x40515d
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403540
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004090ec
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x405140
mov eax, ebx
call fcn.004027f0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40519e
lea eax, [ebp - 0x10]
call fcn.00403410
ret

Function at 0x4051a8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x405267
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004090fc
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x405251
cmp dword [ebp - 8], 0
jbe 0x40524f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004027c0
mov ebx, eax
xor esi, esi
jmp 0x40522d
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403540
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004090ec
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
cmp eax, 0x103
jne 0x405210
mov eax, ebx
call fcn.004027f0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40526e
lea eax, [ebp - 0x10]
call fcn.00403410
ret
Function at 0x405450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x4054cc
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00403788
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00403788
push eax
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403788
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4054c3
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00403570
jmp 0x4054fd
mov eax, edi
call fcn.00403410
jmp 0x4054fd
mov eax, edi
mov edx, esi
call fcn.00403464
mov eax, dword [ebx + 0x19]
call fcn.00403788
push eax
mov eax, esi
call fcn.00403788
push eax
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403788
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408630
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40863c
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x408655
push eax
je 0x408656
call dword [0x41513c]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41513c]
ret

Function at 0x409764
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.00409718
je 0x409796
mov eax, ebx
push edx
call fcn.004068f8
pop edx
cmp eax, edx
je 0x409796
test edx, edx
mov eax, ebx
jne 0x409788
pop ebx
inc edx
jmp fcn.004068e8
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004068e8
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.004097b4
ret