joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4224278
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x42347f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x42346f4]
xor esi, ecx
movzx esi, byte [esi + 0x42346f4]
xor esi, edx
mov esi, dword [esi*4 + 0x42348f4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x42242b2
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x42347f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x42347f4]
xor esi, ecx
movzx esi, byte [esi + 0x42346f4]
xor esi, edx
mov esi, dword [esi*4 + 0x4234cf4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x400], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4224311
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x42346f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x12]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x42346f4]
xor esi, ecx
movzx esi, byte [esi + 0x42347f4]
xor esi, edx
mov esi, dword [esi*4 + 0x42350f4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x800], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4224374
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x42346f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x11]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x42347f4]
xor esi, ecx
movzx esi, byte [esi + 0x42347f4]
xor esi, edx
mov esi, dword [esi*4 + 0x42354f4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0xc00], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x42243d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4224c28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov ebx, dword [0x4240168]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x4235af4
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.04224be8
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.04224be8
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x4224c9f
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x4224c7e
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x4224cda
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4224d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov eax, 0x4235b34
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 5
mov ebx, dword [edx]
xor dword [ecx], ebx
mov ebx, dword [edx + 4]
xor dword [ecx + 4], ebx
add edx, 8
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1800]
mov ebx, dword [ecx]
mov edi, ebx
shr edi, 0x17
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, ebx
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3000]
mov edi, ebx
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3800]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
or esi, 1
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1800]
mov edi, dword [ecx]
shr edi, 0x17
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, dword [ecx]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x3000]
add ebx, ebx
and ebx, 0x1fe
or ebx, 1
xor esi, dword [eax + ebx*4 + 0x3800]
mov dword [ecx + 4], esi
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
dec dword [ebp - 0x10]
jne 0x4224d36
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, 8
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x42358f4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x42358f4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x42358f4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x42358f4]
xor ebx, eax
mov dword [ecx], ebx
mov eax, dword [ecx + 4]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x42358f4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x42358f4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x42358f4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x42358f4]
xor ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
xor eax, dword [ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4225994
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x42259a6
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x42259a2
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x42259fd
xor eax, eax
push ebp
push 0x42259f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42259fd
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x422672c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4226734
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x422688b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x358]
call sub.dbrtl60.bpl__Db_TDataSet_GetActive_qqrv
test al, al
jne 0x4226767
mov eax, dword [ebx + 0x358]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x390]
call sub.vcl60.bpl__Controls_TControl_GetText_qqrv
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call sub.rtl60.bpl__Sysutils_Trim_qqrx17System_AnsiString
cmp dword [ebp - 4], 0
jne 0x42267ae
push 0x80000001
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x42268a0
xor edx, edx
mov eax, 0x42268b4
call sub.vegalib60.bpl__Strtools_ReadStringFromReg_qqr17System_AnsiStringt1t1ui
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x390]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defFirmaNo]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x42268e0
mov edx, dword [ebx + 0x3ac]
mov eax, dword [0x4199094]
call fcn.041991fc
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x324]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defFirmaNo]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defDonemNo]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x4c]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4226910
mov edx, dword [ebx + 0x3ac]
mov eax, dword [0x4199094]
call fcn.041991fc
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x32c]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4226892
lea eax, [ebp - 0x3c]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x20]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x7c5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c506a
add dl, dl
jne 0x7c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c50dc
xor eax, eax
add dl, dl
jne 0x7c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c517d
add dl, dl
jne 0x7c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c5075
mov eax, 1
add dl, dl
jne 0x7c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c50e1
sub eax, ebx
mov ebx, 1
jne 0x7c5128
mov ecx, 1
add dl, dl
jne 0x7c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5136
cmp eax, 0x7d00
jae 0x7c516d
cmp eax, 0x500
jb 0x7c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
cmp eax, 0x7f
ja 0x7c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
push 0x208
call fcn.0040711a
mov edi, 0x104
push edi
mov esi, eax
push 0
push esi
call fcn.00414210
add esp, 0x10
lea eax, [esp + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push str.ZVPath
push str.SOFTWAREMessage_LabsNet_ProtectorConfig
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4010da
lea edx, [esp + 0xc]
push edx
push str.SOFTWAREMessage_LabsNet_ProtectorConfig
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4010da
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push esi
push 0
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4010d3
mov edx, dword [esp + 0xc]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x402910
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x868
mov eax, dword [0x434c44]
xor eax, esp
mov dword [esp + 0x860], eax
push esi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00414210
push esi
lea edx, [esp + 0x70]
push 0x400
push edx
call fcn.0041200f
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00414210
add esp, 0x24
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x80]
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4029b8
mov eax, 1
pop esi
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.00411cc8
add esp, 0x868
ret
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0x864]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00411cc8
add esp, 0x868
ret

Function at 0x402a00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x230
mov eax, dword [0x434c44]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
xor esi, esi
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionScheduleTaskCacheTree_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402aed
push esi
push esi
push esi
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
push esi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x10]
cmp eax, esi
jbe 0x402ae2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x104
call edi
test eax, eax
jne 0x402adb
push str.Np2FactAuth
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x402adb
lea ecx, [esp + 0x28]
push ecx
call fcn.00402360
lea edx, [esp + 0x2c]
add esp, 4
push edx
call fcn.00402b10
add esp, 4
test eax, eax
je 0x402adb
dec esi
inc esi
cmp esi, dword [esp + 0x10]
jb 0x402a86
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00411cc8
add esp, 0x230
ret
Function at 0x403000
Capabilities:
Get session information
Get session user name

Disassembly:
sub esp, 0x10
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 8
push esi
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x403067
cmp dword [esp + 0xc], 4
jne 0x40305d
mov edx, dword [esp + 8]
cmp dword [edx], edi
jne 0x403058
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 5
push esi
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x40305d
mov edx, dword [esp + 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x40305d
mov edi, 1
mov eax, dword [esp + 8]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
cmp edi, 1
pop edi
sete al
pop esi
add esp, 0x10
ret
Function at 0x404170
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100c
call fcn.00415fe0
mov eax, dword [0x434c44]
xor eax, esp
mov dword [esp + 0x1008], eax
push esi
push edi
mov ecx, 0x16
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea edi, [esp + 0x810]
rep movsd dword es:[edi], dword [esi]
push 0x7a6
lea eax, [esp + 0x86e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00414210
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x26]
push edx
mov word [esp + 0x28], cx
call fcn.00414210
add esp, 0x18
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x814]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
pop edi
pop esi
test eax, eax
jne 0x404237
mov ecx, dword [esp]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x42ec34
push ecx
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 8]
push str.Windows_XP
push edx
call fcn.00412178
add esp, 8
test eax, eax
je 0x404237
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call fcn.00411f77
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00411cc8
add esp, 0x100c
ret
Function at 0x404260
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x429160
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x434c44]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x80c]
mov edi, dword [ebp + 0x810]
xor eax, eax
push 0x7fe
mov dword [ebp - 0x2c], ecx
push eax
lea ecx, [ebp + 2]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov word [ebp], ax
call fcn.00414210
push 0x104
lea edx, [ebp]
push 0
push edx
call fcn.00414210
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
push str.SOFTWAREMessage_LabsNet_ProtectorConfig
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40432a
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp]
push edx
push eax
push eax
mov eax, dword [ebp - 0x14]
push str.ZVpath
push eax
mov dword [ebp - 0x18], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.APC_API.DLL
lea edx, [ebp]
push 0x400
push edx
call fcn.0041207e
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40439f
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40439f
push str.SendMail
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x438b54], eax
test eax, eax
je 0x404398
lea edx, [ebp - 0x2c]
push edx
call eax
add esp, 4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x4043a1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00411cc8
add ebp, 0x804
mov esp, ebp
pop ebp
ret

Function at 0x404bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404bc9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404c04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404c00
lea ebx, [ebx]
cmp esi, eax
jae 0x404c04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404bf0
cmp esi, eax
jb 0x404c0a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4055c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0
mov dword [esi], 0
mov eax, dword [edx]
push str.STATUS
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4055fe
mov ecx, dword [esp]
mov dword [esi], ecx
add esp, 8
ret