joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b85e8
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b87a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b877f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x18], 0
jne 0x4b863c
mov dword [ebp - 0x1c], 5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8790
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4b876e
xor eax, eax
push ebp
push 0x4b8767
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 4
cmp eax, dword [ebp - 0x18]
jg 0x4b8744
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add eax, edx
lea edx, [ebp - 0x10]
mov ecx, 4
call fcn.00402d4c
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0040ad88
mov eax, dword [ebp - 0x24]
call fcn.00405304
add eax, dword [ebp - 0xc]
inc eax
cmp eax, dword [ebp - 0x18]
jg 0x4b8744
mov eax, dword [ebp - 0x24]
call fcn.00405304
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
call fcn.00405304
test eax, eax
jle 0x4b86e5
mov eax, dword [ebp - 0x24]
call fcn.00405504
push eax
call sub.user32.dll_RegisterClipboardFormatA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 4
cmp eax, dword [ebp - 0x18]
jg 0x4b8744
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add eax, edx
lea edx, [ebp - 4]
mov ecx, 4
call fcn.00402d4c
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jg 0x4b8744
cmp dword [ebp - 0x10], 0
je 0x4b8739
push ebp
call fcn.004b84f4
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4b8739
call fcn.00404a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8790
mov eax, dword [ebp - 4]
add dword [ebp - 0xc], eax
jmp 0x4b8669
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8775
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b8766
call sub.user32.dll_CloseClipboard
ret
mov dword [ebp - 0x1c], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b87ad
lea eax, [ebp - 0x24]
call fcn.00405044
ret
Function at 0x4c2a18
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4c2af5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x4d390c]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c2aeb
mov eax, dword [0x4d390c]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
je 0x4c2ad3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c2ad3
push 4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindow
test eax, eax
jne 0x4c2ad3
push 0x12d
lea eax, [ebp - 0x131]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x4c2ad3
push 0
push 0
push 0x12
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push 0x12d
lea eax, [ebp - 0x131]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4c2ad3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c2ad3
push 0
push 0
push 0x10
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push 2
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c2a4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2aff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c2b08
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [0x4d3b78]
cmp dword [eax], 0x401
jne 0x4c2b34
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
jne 0x4c2b2a
push 0
push 4
call sub.user32.dll_ExitWindowsEx
jmp 0x4c2ba8
xor edx, edx
xor eax, eax
call fcn.00408634
ret
mov eax, dword [0x4d3b78]
cmp dword [eax], 0x406
jne 0x4c2b4c
push 0
push 6
call sub.user32.dll_ExitWindowsEx
jmp 0x4c2ba8
mov eax, dword [0x4d3b78]
cmp dword [eax], 0x404
je 0x4c2b66
mov eax, dword [0x4d3b78]
cmp dword [eax], 0x405
jne 0x4c2ba8
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
je 0x4c2b8b
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
push 0x64
call sub.kernel32.dll_Sleep_1
push 0
push 5
call sub.user32.dll_ExitWindowsEx
jmp 0x4c2ba8
call fcn.00464220
test al, al
je 0x4c2b9f
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
jmp 0x4c2ba8
push 0
push 5
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x4c2e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
xor eax, eax
push ebp
push 0x4c3039
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c3009
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0044e5f8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x140], 0x128
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0xc]
call fcn.0044e618
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4c2f6a
lea eax, [ebp - 0x1a0]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004052b4
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.0040a90c
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.0040983c
mov eax, dword [ebp - 0x198]
push eax
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 4]
call fcn.0040983c
mov edx, dword [ebp - 0x1a4]
pop eax
call fcn.00405450
je 0x4c2f41
lea eax, [ebp - 0x1ac]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004052b4
mov eax, dword [ebp - 0x1ac]
lea edx, [ebp - 0x1a8]
call fcn.0040983c
mov eax, dword [ebp - 0x1a8]
mov edx, 0x4c3050
call fcn.00405450
jne 0x4c2f59
mov eax, dword [ebp - 0x138]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
jmp 0x4c2f74
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0xc]
call fcn.0044e638
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c2ead
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x14], 0
jne 0x4c2f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c3013
lea eax, [ebp - 0x194]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x10]
push eax
push 0xb
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4c2fff
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.0040555c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
sbb eax, eax
inc eax
test al, al
jne 0x4c2fff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c3013
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c3013
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3040
lea eax, [ebp - 0x1ac]
mov edx, 6
call fcn.00405068
lea eax, [ebp - 4]
call fcn.00405044
ret
Function at 0x4c3060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
xor eax, eax
push ebp
push 0x4c3189
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a824
push dword [ebp - 0x14]
push 0x4c319c
push 0x4c31a8
push 0x4c31c0
lea eax, [ebp - 8]
mov edx, 4
call fcn.004053c4
mov eax, dword [ebp - 8]
call fcn.0040a4d4
test al, al
jne 0x4c3134
mov eax, dword [ebp - 4]
mov edx, 0x4c31cc
call fcn.00405450
jne 0x4c30f4
lea edx, [ebp - 0x1c]
mov eax, 0x7dc
call fcn.0040a330
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, 0x4c31c0
call fcn.00405350
jmp 0x4c3111
lea edx, [ebp - 0x20]
mov eax, 0x7dd
call fcn.0040a330
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov ecx, 0x4c31c0
call fcn.00405350
push 1
push 0
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4c31e0
mov eax, dword [0x4d390c]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c3161
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004050dc
push 1
push 0
lea eax, [ebp - 0xc]
call fcn.0040555c
push eax
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4c31e0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3190
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405068
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405068
ret
Function at 0x4c31e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4c31f0
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c3486
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xffff63bf
cmp eax, 6
ja case.default.0x4c321a
jmp dword [eax*4 + 0x4c3221]
push ebp
mov eax, 0x4c349c
call fcn.004c3060
pop ecx
jmp case.default.0x4c321a
push ebp
xor eax, eax
call fcn.004c3060
pop ecx
jmp case.default.0x4c321a
call fcn.004c254c
cmp al, 1
jne case.default.0x4c321a
call fcn.004c2434
mov eax, 0x4c34b0
call fcn.004644e8
jmp case.default.0x4c321a
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a824
push dword [ebp - 0x14]
push 0x4c34c8
push 0x4c34d4
push 0x4c34f0
lea eax, [ebp - 8]
mov edx, 4
call fcn.004053c4
mov eax, dword [ebp - 8]
call fcn.0040a4d4
test al, al
jne 0x4c32ea
push 0x10
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4c34fc
call fcn.00405350
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x44df70]
call fcn.0044dff4
push 0x64
call sub.kernel32.dll_Sleep_1
jmp case.default.0x4c321a
call fcn.004373d4
cmp al, 6
jb 0x4c33b7
call fcn.004358c4
test al, al
je 0x4c33b7
call fcn.004373d4
cmp al, 6
jbe 0x4c33a8
call fcn.004373d4
cmp al, 9
jb 0x4c3361
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a824
push dword [ebp - 0x20]
push 0x4c34c8
push 0x4c3518
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0xc]
call fcn.0040a4d4
test al, al
jne 0x4c336b
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402f58
jmp 0x4c336b
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402f58
lea eax, [ebp - 8]
mov ecx, 0x4c34f0
mov edx, dword [ebp - 0xc]
call fcn.00405350
push 0x4c3528
push dword [ebp - 0xc]
push 0x4c3534
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004053c4
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00463388
jmp case.default.0x4c321a
push ebp
mov eax, dword [ebp - 8]
call fcn.004c2e20
pop ecx
jmp case.default.0x4c321a
push 1
push 0
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4c354c
mov eax, dword [0x4d390c]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4c321a
call fcn.004c2434
mov eax, 0x4c355c
call fcn.004644e8
jmp case.default.0x4c321a
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040a824
push dword [ebp - 0x2c]
push 0x4c34c8
lea edx, [ebp - 0x34]
mov eax, 0x7d0
call fcn.0040a330
push dword [ebp - 0x34]
push 0x4c356c
push 0x4c34f0
lea eax, [ebp - 8]
mov edx, 5
call fcn.004053c4
push 1
push 0
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4c354c
mov eax, dword [0x4d390c]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4c321a
push 0
push 0
push 0x408
mov eax, dword [0x4d390c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c348d
lea eax, [ebp - 0x34]
mov edx, 0xc
call fcn.00405068
ret
Function at 0x4c5284
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c5305
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
call fcn.00402b20
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040523c
mov edx, dword [ebp - 0xc]
inc edx
mov eax, dword [ebp - 0x10]
call fcn.00402b50
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00405098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c530c
lea eax, [ebp - 0x14]
call fcn.00405044
ret

Function at 0x4c6f18
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x94], 6
setae byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4cca74
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 2
push 0
push 0
push 0
push 0x4ccad8
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4ccacf
mov eax, dword [ebp + 0xc]
call fcn.0040ab58
inc eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x4ccb24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x4ccba0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ccb95
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ccb8c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x4ccc1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 2
push 0
push 0
push 0
push 0x4ccc9c
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4ccc92
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 1
jmp 0x4ccc61
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x4ccc5a
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x4ccd04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x4ccd80
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4ccd75
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4ccd6c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x60e9461b
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x2557522b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x7e31f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x7e3352
cmp edi, esi
je 0x7e3352
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x7e3342
add edi, 4
jmp 0x7e32a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x7e32b8
mov dword [ebp - 4], 2
jmp 0x7e32d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x7e32cf
mov dword [ebp - 4], 1
jmp 0x7e32d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x7e3352
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x7e3310
mov byte [ecx + 2], 0x3d
jmp 0x7e331d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x7e332c
mov byte [ecx], 0x3d
jmp 0x7e3332
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x7e32a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x859f74
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, 0x193ae1b0
and al, 0xe6
out dx, al
and dword [edx], ecx
cdq
xor ah, al
sub al, 0xdf
aas
mov ah, 0x19
add dl, byte [ebp - 0x6d]
cmc
inc edi
std
jge entry0
ljmp 0x6c1e:0x2688048f
Function at 0x402ad0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042f0
test esi, esi
jne 0x402b06
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004043e0
jmp 0x402b24
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029e4
mov edi, eax
test esi, esi
je 0x402b24
cmp dword [ebx], 0
je 0x402b24
dec esi
jmp 0x402b0d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403284
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d2020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40331c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032fc
xor eax, eax
push ebp
push 0x4032f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403338
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d2020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d2020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404174
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d504c], 0
je 0x4041d5
cmp word [0x4d5220], 0xd7b2
jne 0x40419d
cmp dword [0x4d5228], 0
jbe 0x40419d
mov eax, 0x4d521c
call dword [0x4d5238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d206c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d2030], 0
jne 0x4041f1
push 0
push 0x4d2064
push 0x4d206c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret