joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405de7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405e0c
mov eax, dword [0x40a060]
cmp eax, 0xffffffff
je 0x405e03
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [0x40a060], 0xffffffff
jmp 0x405e81
cmp dword [0x43fb78], ebx
je 0x405e81
cmp byte [0x444380], bl
je 0x405e4b
cmp dword [0x40a060], 0xffffffff
jne 0x405e54
push 4
push 0x40000000
push 0x444380
call fcn.00405b9b
mov dword [0x40a060], eax
cmp eax, 0xffffffff
je 0x405e81
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp dword [0x40a060], 0xffffffff
je 0x405e81
push esi
push 0x408cdc
mov esi, 0x43fb80
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [0x40a060]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40607e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x43aa38
push esi
call fcn.00405d2b
push esi
call fcn.00405b04
mov edi, eax
test edi, edi
jne 0x40609f
xor eax, eax
jmp 0x4060f7
push edi
call fcn.00405d4d
test byte [0x448868], 0x80
je 0x4060b8
mov al, byte [edi]
test al, al
je 0x40609b
cmp al, 0x5c
je 0x40609b
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub edi, esi
jmp 0x4060d8
push esi
call fcn.00405f99
test eax, eax
je 0x4060d2
test byte [eax], 0x10
je 0x4060fc
push esi
call fcn.00406057
push esi
call ebx
cmp eax, edi
jg 0x4060c3
push esi
call fcn.0040602a
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4060f6
Function at 0x4063b0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405fc0
mov esi, dword [esp + 0x18]
test eax, eax
je 0x4063d4
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40650d
mov ebx, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov dword [0x43ca38], 0x4c554e
mov edi, 0x400
mov ebp, 0x43ca38
test esi, esi
je 0x406418
push 1
push 0
push esi
call fcn.00405b9b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406513
cmp eax, edi
jg 0x406513
push edi
mov esi, 0x43d378
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406513
cmp eax, edi
jg 0x406513
push esi
push ebp
push str._s_s_r_n
push 0x43ce38
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4487ec]
push dword [eax + 0x150]
push esi
call fcn.00406156
push 4
push 0xc0000000
push esi
call fcn.00405b9b
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x40650d
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406506
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x406506
cmp edi, dword [esp + 0x18]
jne 0x406506
push str._Rename__r_n
push esi
call fcn.00406100
test eax, eax
jne 0x40651a
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.00405d2b
add edi, 0xa
mov eax, edi
push ebx
push 0x43ce38
add eax, esi
push eax
call fcn.00405b57
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [0x4488d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x408d88
add eax, 0xa
push eax
call fcn.00406100
test eax, eax
je 0x4064d1
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x406541
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x406536
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4064d3
Function at 0x40676d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43f77c], 0
jne 0x4067ab
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406781
mov dword [ecx*4 + 0x43f778], eax
inc ecx
cmp ecx, 0x100
jl 0x40677c
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067d8
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43f778]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4067b9
not eax
pop ebp
ret 0xc
Function at 0x401390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a693
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004290ec
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.004290ec
or eax, 0xffffffff
push 0x44d100
mov dword [ebx], method.CPtrArray.virtual_0
push edi
mov dword [esi], 0x43d6dc
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4043d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43aa68
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x58], ebp
jne 0x404406
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov eax, dword [0x44b0d8]
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0x10]
or ebx, 0xffffffff
push ecx
mov byte [esp + 0x34], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, ebp
mov dword [esp + 0x24], eax
jle 0x40450a
push esi
cmp ebx, 0xffffffff
jne 0x4044f3
push 0x400
push 0x100
push 0x100
lea ecx, [esp + 0x1c]
call fcn.0042a43e
mov edx, dword [edi + 4]
push eax
push ebp
push edx
call dword [sym.imp.USER32.dll_GetMenuStringA]
push ebx
lea ecx, [esp + 0x14]
call fcn.0042a48d
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4044e6
mov eax, dword [esp + 0x18]
xor esi, esi
test eax, eax
jle 0x4044e6
mov edx, dword [edi + 0xc]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [edx + esi*4]
call fcn.00401250
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.0042a147
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 1
call fcn.0042a00e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0041bd85
add esp, 8
test eax, eax
je 0x4044e0
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jl 0x404492
jmp 0x4044e6
mov ebx, ebp
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x28]
inc ebp
cmp ebp, eax
jl 0x404446
test ebx, ebx
pop esi
jl 0x40450a
mov eax, dword [esp + 0x18]
test eax, eax
jl 0x40450a
cmp ebx, eax
jl 0x40450a
sub ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.0042a00e
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0042a00e
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x404c20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x43ab70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.00430dd4
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00430495
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.004308e5
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.00430931
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004308e5
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.00430931
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.004308e5
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.00430931
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004308e5
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.00430931
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.004308e5
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.00430931
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.004308e5
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.00430931
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.004308e5
push ebp
push ebx
mov ecx, esi
call fcn.00430931
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00430495
lea ecx, [esp + 0x10]
call fcn.00430e2b
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.00430e2b
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x405c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43aca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], vtable.CBrush.0
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00401500
test eax, eax
je 0x405cce
push 0xf
jmp 0x405cd0
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x405cf1
push 0x3fe33333
push 0x33333333
push eax
call fcn.00402430
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.00430dd4
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.00430e2b
call fcn.004014f0
test eax, eax
je 0x405d49
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
push 7
test eax, eax
jne 0x405d6d
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.00404c20
jmp 0x405d85
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.00404b00
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.00430e2b
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x406390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004375c8
mov edi, dword [esp + 0x14]
mov ebx, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x4063cb
xor ebx, ebx
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x4063cb
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4063dc
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4063ec
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.00406350
add esp, 4
cmp ax, 0x10
je 0x406402
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push ebx
call fcn.00431895
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4064c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x44d120]
sub esp, 0x134
test eax, eax
jne 0x406595
lea eax, [esp]
mov dword [0x44d120], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406595
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406588
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x406588
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406588
mov dword [0x44d11c], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x44d11c]
add esp, 0x134
ret
Function at 0x408380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43af88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x1c]
push eax
call edi
push eax
call fcn.0042abfe
push eax
lea ecx, [esp + 0x30]
call fcn.00430b2c
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x1c]
push edx
call edi
push eax
call fcn.0042abfe
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.004309e2
mov eax, dword [esi + 0x148]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x4084b6
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x144]
call fcn.00430301
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, edi
push eax
push ecx
push edx
lea edi, [esi + 0x154]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.00430dd4
test edi, edi
je 0x408462
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x148]
push edi
push eax
call fcn.00430442
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x15c], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x148]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0x144]
sub ecx, edi
test edx, edx
je 0x4084d7
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.00430b9e
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x409928
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b008
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.004375c8
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
push 0x2000
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
jne 0x409960
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x43d708
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.00430dd4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0042abfe
push eax
lea ecx, [esp + 0x10]
call fcn.00430b2c
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.004096c0
lea ecx, [esp + 4]
mov esi, eax
call fcn.00430e2b
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00430b9e
mov dword [esp + 4], vtable.CGdiObject.0
lea ecx, [esp + 4]
mov dword [esp + 0x28], 2
call fcn.00430e2b
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x40cbc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43b5f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x6c]
test eax, eax
jne 0x40cc6a
mov eax, dword [0x44b0d8]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0042a43e
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0042a48d
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0042a3ea
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40cc51
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x40cc51
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x6c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0042a00e
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40cc80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40cce2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x40cef0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40cfe2
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocStringLen
mov ecx, edi
call fcn.0040cc80
test eax, eax
jne 0x40cfe2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocStringLen
mov ecx, edi
call fcn.0040cc80
test eax, eax
jne 0x40cfe2
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.0041c09e
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cfb3
lea eax, [esp + 0x10]
push 0x44a610
push eax
call fcn.0041c09e
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cfb3
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x40cfb6
mov byte [esi], 0
push 0x44a0f4
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x40f850
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
xor eax, eax
mov edx, dword [edi + 8]
mov bl, byte [eax + esi]
mov dl, byte [edx + eax]
xor bl, dl
mov dl, bl
mov byte [eax + esi], bl
add cl, dl
inc eax
cmp eax, 8
jl 0x40f85f
cmp cl, byte [esi + 8]
jne 0x40f8e5
xor eax, eax
lea ecx, [esi + 0xd]
mov edx, eax
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x40f890
dec edx
or edx, 0xfffffff8
inc edx
mov dl, byte [edx + esi]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, 0x118
jl 0x40f881
push 8
push str.GSND_ACK
push ecx
call fcn.0040f8f0
add esp, 0xc
test eax, eax
jne 0x40f8da
mov ecx, dword [edi]
cmp word [ecx + 8], ax
jbe 0x40f8ec
mov ecx, dword [ecx + 0xc]
mov dl, byte [esi + eax + 0x25]
mov byte [ecx + eax], dl
mov ecx, dword [edi]
xor edx, edx
inc eax
mov dx, word [ecx + 8]
cmp eax, edx
jl 0x40f8bf
pop edi
pop esi
pop ebx
ret
mov dword [esi + 9], 0x1fbd1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 9], 0x1adc2
pop edi
pop esi
pop ebx
ret