joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11e0dba0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11e1c6a0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.11da14f0
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.11da14f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x11e4c8c8]
test eax, eax
je 0x11e0dc58
cmp ebp, eax
jne 0x11e0dc58
mov eax, dword [0x11e4c8cc]
test eax, eax
je 0x11e0dc58
cmp ebx, eax
jb 0x11e0dc58
add eax, 0x493e0
cmp eax, ebx
jb 0x11e0dc58
mov ebp, dword [0x11e4c8d0]
push 1
inc ebp
push 0x11e4c7e8
lea ecx, [esp + 0x18]
mov dword [0x11e4c8d0], ebp
call fcn.11daa230
push 0x11e4c818
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.11da16d0
push 0x11e4c808
mov ecx, edi
call fcn.11da16d0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x11e0dcce
push edi
push esi
mov dword [0x11e4c8d0], 0
call fcn.11e0dfd0
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x11e4c7e8
call fcn.11daa230
push 0xffffffffffffffff
push 0
mov ecx, 0x11e4c818
mov dword [esp + 0x38], 1
mov dword [0x11e4c8c8], ebp
mov dword [0x11e4c8cc], ebx
call fcn.11da14f0
push esi
mov ecx, 0x11e4c818
call fcn.11da16d0
push 0xffffffffffffffff
push 0
mov ecx, 0x11e4c808
call fcn.11da14f0
push edi
mov ecx, 0x11e4c808
call fcn.11da16d0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.11daa290
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x11e0dfd0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11e1c706
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.11da14f0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.11da14f0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x11e0e109
mov edx, dword [0x11e4545c]
mov cx, word [0x11e45460]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11d9b3c0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.11da1a90
mov edx, dword [0x11e1da04]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.11d9bde0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.11da1a90
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11d9bb60
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11d9bb60
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x11e0e02b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x11e12272
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push accept
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x11e12302
cmp eax, ebx
je 0x11e12302
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x11e1230a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x11e124b5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x11e12607
xor edx, edx
cmp eax, edx
je 0x11e12607
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x11e124ea
cmp eax, ecx
jb 0x11e124ea
xor ecx, ecx
jmp 0x11e124ef
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x11e12509
jg 0x11e12607
cmp eax, dword [esi + 8]
ja 0x11e12607
cmp ecx, edx
jne 0x11e12523
cmp eax, dword [esi + 0x42c]
ja 0x11e12523
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x11e12568
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x11e12543
cmp edi, edx
jb 0x11e12543
xor edx, edx
jmp 0x11e12548
mov edx, 1
cmp ecx, ebx
ja 0x11e12568
cmp dword [esp + 0x14], edx
jg 0x11e12568
jl 0x11e12558
cmp eax, edi
ja 0x11e12568
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.11e12620
test eax, eax
je 0x11e12607
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x11e125b6
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push accept
push ecx
call edi
cmp eax, 0xffffffff
je 0x11e125f7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x11e125f7
jmp 0x11e125c6
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x11e125f7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x11e125f7
cmp dword [edi], ebp
jne 0x11e125f7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x41d4c0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x41d648
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x41d4ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41d4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41d4e0
mov eax, 1
add ebx, ebx
jne 0x41d503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41d4f8
jne 0x41d514
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41d4f8
xor ecx, ecx
sub eax, 3
jb 0x41d528
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41d59a
mov ebp, eax
add ebx, ebx
jne 0x41d533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41d540
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41d564
inc ecx
add ebx, ebx
jne 0x41d550
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41d545
jne 0x41d561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41d545
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41d584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41d575
jmp 0x41d4e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41d584
add edi, ecx
jmp 0x41d4e6
pop esi
mov edi, esi
mov ecx, 0x861
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41d5a2
cmp byte [edi], 6
jne 0x41d5a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41d5a7
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d616
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1edd0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ee48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41d5d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ee4c]
or eax, eax
je 0x41d610
mov dword [ebx], eax
add ebx, 4
jmp 0x41d5f1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41d647
cmp al, 0xef
ja 0x41d63a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41d61c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x41d629
popal
jmp 0x4123bc
Function at 0x40dd2b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, ecx
test esi, esi
jns 0x40dd59
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
and esi, 0x7fffffff
push eax
add esi, edx
push esi
call fcn.0040ddda
add esp, 0xc
jmp 0x40ddd6
push ebx
mov ecx, 0x7fffffff
and esi, ecx
add esi, edx
lea eax, [ebp + 8]
mov ebx, dword [esi]
and dword [ebp + 8], 0
push eax
push 4
push dword [esi + 4]
and ebx, ecx
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40ddd5
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
mov ecx, dword [eax + 0x1c]
push 0
sub ecx, edi
test byte [ebp + 0xc], 0x40
pop eax
setne al
lea eax, [eax*2 - 1]
push eax
mov eax, dword [0x649d84]
imul eax, dword [esi]
push eax
mov eax, dword [0x649d8c]
imul eax, dword [esi]
push eax
mov eax, dword [0x649d80]
mov edx, dword [esi + 4]
xor eax, ecx
push eax
mov ecx, ebx
call fcn.0040e359
add esp, 0x14
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40e309
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
mov ebx, dword [ecx + 0x3c]
add ebx, ecx
push ebp
movzx eax, word [ebx + 0x14]
lea ebp, [ebx + 0x18]
add ebp, eax
push esi
xor eax, eax
xor esi, esi
push edi
mov dword [esp + 0x10], edx
cmp ax, word [ebx + 6]
jae 0x40e349
mov edi, ebp
push edi
push edx
call fcn.0041df86
pop ecx
pop ecx
test eax, eax
je 0x40e351
movzx eax, word [ebx + 6]
mov edx, dword [esp + 0x10]
inc esi
add edi, 0x28
cmp esi, eax
jb 0x40e32c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
imul esi, esi, 0x28
lea eax, [esi + ebp]
jmp 0x40e34b
Function at 0x40ee5b
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x436948
call fcn.00428a60
mov esi, ecx
and dword [ebp - 4], 0
lea edi, [esi + 0x80]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x40ef5c
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x40ef4b
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x40ef4b
mov dword [ebp - 4], 1
lea edi, [esi + 0xc0]
push dword [ebp + 0xc]
push 0xf8
push eax
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x40ef5c
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x40ef4b
mov eax, 0x10b
cmp word [esi + 0xd8], ax
jne 0x40ef4b
movzx eax, word [esi + 0xc6]
test ax, ax
je 0x40ef4b
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0xd4]
mov ebx, dword [esi + 0xbc]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.0041e098
pop ecx
mov dword [esi + 0x1b8], eax
test eax, eax
jne 0x40ef20
push 8
jmp 0x40ef62
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x40ef5c
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x18], eax
xor eax, eax
jmp 0x40ef63
push 0xb
jmp 0x40ef62
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00428a9b
ret 8

Function at 0x411c49
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ecx, 0xff077af4
test edi, edi
je 0x411c82
movzx eax, byte [ebx]
cdq
push 0
xor esi, edx
push 0x1000193
xor ecx, eax
push esi
push ecx
inc ebx
call fcn.00428430
xor esi, esi
mov ecx, eax
dec edi
jne 0x411c64
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411c8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x64d1e0]
or eax, dword [0x64d1e4]
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0xc], ebx
mov edi, ecx
jne 0x411ceb
xor esi, esi
mov eax, esi
push 8
cdq
pop ebx
mov ecx, eax
shrd eax, edx, 1
and ecx, 1
shr edx, 1
or ecx, 0
je 0x411ccd
xor eax, 0xd7870f42
xor edx, 0xc96c5795
dec ebx
jne 0x411cb2
mov dword [esi*8 + 0x64c9e8], eax
mov dword [esi*8 + 0x64c9ec], edx
inc esi
cmp esi, 0x100
jl 0x411cac
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not ecx
not edx
test edi, edi
je 0x411d1c
movzx eax, byte [edi]
xor eax, ecx
shrd ecx, edx, 8
and eax, 0xff
shr edx, 8
xor ecx, dword [eax*8 + 0x64c9e8]
xor edx, dword [eax*8 + 0x64c9ec]
inc edi
dec ebx
jne 0x411cf9
pop edi
not ecx
pop esi
not edx
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417232
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42a5be
push eax
mov dword fs:[0], esp
sub esp, 0x38
cmp dword [0x64c9bc], 0
push esi
je 0x4172d1
mov esi, 0x64c9ac
push ecx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.0041945a
mov ecx, eax
call fcn.00419683
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x417282
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
push dword [eax + ecx*4]
lea ecx, [esp + 0x24]
call fcn.00410f76
and dword [esp + 0x44], 0
mov ecx, esi
call fcn.0041930f
cmp dword [esp + 0x34], 0x10
mov eax, dword [esp + 0x20]
jae 0x4172b3
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00402161
cmp dword [0x64c9bc], 0
jne 0x41725f
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4172e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x42955c
call fcn.0041e7dc
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0x10
mov edi, edx
jb 0x4172ff
mov eax, dword [esi]
jmp 0x417301
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4173af
push ecx
push ecx
mov ecx, esi
call fcn.00418965
cmp eax, 0xffffffff
je 0x417354
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00410ce2
and dword [ebp - 4], 0
mov edx, edi
mov ecx, eax
call fcn.004172e1
mov bl, al
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00402161
inc bl
je 0x417354
xor al, al
jmp 0x4173bb
mov ecx, dword [0x64bd90]
test ecx, ecx
je 0x417371
cmp dword [esi + 0x14], 0x10
jb 0x417368
mov eax, dword [esi]
jmp 0x41736a
mov eax, esi
push 0
push eax
call ecx
jmp 0x41739b
cmp dword [0x64ac48], 0
je 0x417399
push 0x18
pop eax
call fcn.0041ec00
push esp
push 0x435014
call fcn.0040e0df
push eax
call dword [0x64ac48]
add esp, 0xc
jmp 0x417350
xor eax, eax
test eax, eax
je 0x417350
push esi
mov ecx, 0x64c9ac
call fcn.0041928c
mov byte [edi], 0
jmp 0x4173b9
test eax, 0x410
je 0x417350
mov byte [edi], 1
mov al, 1
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418019
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x42a5a2
call fcn.0041e7dc
mov eax, 0x1030
call fcn.0041ec00
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x1048], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x645b18
push 0x80000001
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xf
pop edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [esp + 0x1048], ebx
xor ebp, ebp
inc ebp
mov dword [esp + 0x1c], ebp
test eax, eax
jne 0x41810f
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x1068]
mov dword [esp + 0x24], 0x1000
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x3c], bl
test eax, eax
jne 0x418105
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x418105
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004024bb
mov dword [esp + 0x1048], ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00410bde
mov byte [esp + 0x1048], bl
lea ecx, [esp + 0x20]
call fcn.00402161
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1040]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41a879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [0x645120]
push edi
test edx, edx
je 0x41a8a3
lea eax, [edx - 1]
shr eax, 2
inc eax
imul ecx, ecx, 0x4848c0c0
xor ecx, esi
sub edx, 4
dec eax
jne 0x41a895
mov eax, dword [ebp + 8]
shr edx, 2
lea edi, [eax + edx*4]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x41a8d4
dec edx
shr edx, 2
inc edx
imul ecx, ecx, 0x4848c0c0
xor ecx, esi
mov eax, ecx
not eax
xor dword [edi], eax
lea edi, [edi + 4]
dec edx
je 0x41a8d4
mov esi, dword [0x645120]
jmp 0x41a8b8
pop edi
pop esi
pop ebp
ret
Function at 0x4261b3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x644b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.0041b16e]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041f77e
mov dword [ebp - 0x14], eax
cmp dword [0x64ab78], edi
jne 0x4262a4
push 0x800
push edi
push 0x42d298
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x426231
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x426384
push 0x42d298
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x426384
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426384
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x64ab78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x64ab7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x64ab80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64ab88], eax
test eax, eax
je 0x4262a1
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64ab84], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4262c9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4262bc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4262de
push 4
pop eax
jmp 0x426386
cmp dword [ebp - 0x14], edi
je 0x4262de
push dword [0x64ab78]
call dword [fcn.0041b172]
push 3
jmp 0x4262c3
mov eax, dword [0x64ab84]
mov ebx, dword [fcn.0041b172]
cmp eax, esi
je 0x42633c
cmp dword [0x64ab88], esi
je 0x42633c
push eax
call ebx
push dword [0x64ab88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42633c
test eax, eax
je 0x42633c
call ecx
test eax, eax
je 0x426331
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x426331
test byte [ebp - 8], 1
jne 0x42633c
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x42636c
mov eax, dword [0x64ab7c]
cmp eax, esi
je 0x426369
push eax
call ebx
test eax, eax
je 0x426369
call eax
mov edi, eax
test edi, edi
je 0x426369
mov eax, dword [0x64ab80]
cmp eax, esi
je 0x426369
push eax
call ebx
test eax, eax
je 0x426369
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x64ab78]
call ebx
test eax, eax
je 0x426384
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x426386
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f4df
leave
ret
Function at 0x403fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x420f48
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x42c6dc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x42c6dc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4040f4
cmp byte [ebx + 0x45], 0
je 0x4040f4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x404000
xor al, al
jmp 0x4040f6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x404040
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x404081
dec eax
je 0x404085
sub eax, 2
je 0x4040db
xor bl, bl
jmp 0x4040dd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x4040bc
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.0040b503
add esp, 0x10
cmp esi, eax
jne 0x40407d
cmp byte [ebx + 0x45], 0
je 0x4040db
test esi, esi
jne 0x404040
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00403aa0
jmp 0x404040
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4040f0
push dword [esp + 0x18]
call fcn.0040b328
add esp, 4
mov al, bl
jmp 0x4040f6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00409fff
mov esp, ebp
pop ebp
ret