joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f99bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xe5c64
jmp 0x100f999f
pushfd
jmp 0x100f8391
mov cl, 0xbf
cpuid
lea esi, [ecx + esi]
lea edx, [eax*4]
jmp 0x100f99dc
push edx
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x100f9999
xchg al, ch
xchg bx, cx
ror esi, cl
je 0x100f99ff
lea ecx, [ecx*4]
jmp 0x100f99e9
mov ebp, dword [esp + 0x2c]
xchg cl, bh
xchg esi, ecx
lea edi, [esp]
jmp 0x100f99c6
sub esp, 0xc0
jmp 0x100f9a1e
lea ecx, [ecx*4]
jmp 0x100f99e9
mov ebx, ebp
ror dx, 0xf
jo 0x100f9a6b
mov eax, ecx
jmp 0x100f9a3f
mov esi, esp
mov ch, 0xc8
lea ebx, [edx + 0x10]
mov al, byte [esp]
mov cx, 0x198f
jmp 0x100f9a08
mov eax, ecx
mov cx, 0x1a25
xchg dx, cx
lea ecx, [eax*4]
mov dl, 0xc6

Function at 0x100f9b46
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ax
mov eax, 0x7266c27d
inc dx
bt eax, eax
mov eax, 0x8c592c2
jmp 0x100f9b30

Function at 0x10102470
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101024bb
pushfd
lea esp, [esp + 4]
jmp 0x100e8c06

Function at 0x1010eece
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
xor bl, 0x98
inc ch
jl 0x1010ebd5
bswap ecx
jmp 0x1010ec0e

Function at 0x10118c6d
Capabilities:
Encrypt data using aes

Disassembly:
mov bh, 0xc2
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x10118ca5
pop ebp
mov bx, cx
mov dword [ecx], edx
jmp 0x10118c57
movzx edx, byte [eax + 4]
dec bp
push ebx
jmp 0x10118c8f

Function at 0x10118f9a
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x1c]
xor eax, dword [ecx]
jmp 0x10118fd1
stc
jmp 0x10118fdc
lea edi, [ecx + 0x10]
stc
xor ebx, eax
sub esp, 0xc
jmp 0x10118fbb
mov dword [edi], eax
not eax
mov eax, dword [ecx + 8]
jmp 0x10119015
lea esp, [esp + 1]
jmp 0x1011904f
xor eax, ebx
mov dword [ecx + 0x14], ebx
pushal
lea esp, [esp + 0x1b]
mov bh, byte [esp + 4]
jmp 0x10118fff
mov dword [ecx + 0x18], eax
bsf ebx, edi
rcl bx, cl
bswap ebx
jmp 0x10119039

Function at 0x10119165
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
and edi, 0xff000000
jmp 0x10119191
xor ecx, edi
bsr di, si
mov di, 0xae0f
bsr di, bp
jmp 0x10119b4c
and edx, ebp
jmp 0x101191e8
xor ecx, edi
mov edi, 0x46916917
mov di, word [esp]
mov di, word [esp]
neg edi
jmp 0x101191bf
xor ecx, edx
mov dx, 0x8df5
cmp edx, 0x6947e7c6
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x10119218
lea esi, [esi*4]
lea esi, reloc.KERNEL32.dll_FindFirstFileA
movzx edi, byte [esi]
pop esi
jmp 0x101191d5
lea esp, [esp + 0x34]
xor ecx, dword [ebx]
call fcn.10119261
xor byte [eax + 0x15a05136], ah
dec esi
fisttp qword [ebp + 0x14]
out 0x56, eax
mov eax, 0x36dbbc2e
test byte [edi + 0x60563186], bh
push esi
pushal
mov dword [esp + 4], edi
clc
popal
jmp 0x10119205
mov edx, dword [edi]
pop edi
pushfd
shr edi, 0x18
jmp 0x10119238
push edi
mov edi, edx
lea edi, [edi*4]
lea edi, reloc.KERNEL32.dll_FindFirstFileA
jmp 0x10119326
mov edi, edx
and edx, esi
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x10119424
Function at 0x10119261
Capabilities:
Encrypt data using aes

Disassembly:
lea edi, [eax + 0x10]
sub esp, 2
lea edx, [edi*4]
lea esp, [esp + 2]
jmp 0x1011928b
mov dl, byte [esp + 3]
pop di
lea esp, [esp + 2]
jmp 0x10119242
sub esp, 5
push word [esp + 1]
pop word [esp]
lea esp, [esp + 1]
jmp 0x101192b7
xor ecx, dword [eax]
mov edx, 0xbc97b640
add ebx, 4
btc dx, bp
jmp 0x1011926d
mov edx, dword [eax + 4]
xor edx, ecx
or cl, dh
bsf ecx, edx
sets cl
jmp 0x101192fa
mov dword [edi], ecx
mov dh, 0x63
mov edx, 0x43d8cbc4
mov dx, word [esp]
jmp 0x1011929b
mov dl, byte [esp]
mov dx, word [esp]
jmp 0x10119307
mov ecx, dword [eax + 8]
stc
xor ecx, edx
mov dword [eax + 0x18], ecx
jmp 0x101192c6
mov dword [eax + 0x14], edx
mov ch, bl
mov ecx, dword [esp]
rcl ecx, 0x1d
jmp 0x101192dc
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
jmp 0x1011937b
mov edi, dword [esp]
jmp 0x10119357
push 0xa
lea eax, [edi - 0x6d]
mov ebp, 0xfea4e829
pop eax
jmp 0x10119332
mov esi, dword [esp + 4]
lea esp, [esp + 8]
pop ebp
mov ebx, edi
jmp 0x101193ed
stc
lea esp, [esp + 4]
cmp ebx, 0x100f3494
jne 0x100e6a0b
je 0x1011934a
pop ebx
ret

Function at 0x10119567
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, 0x8d76a5a7
jmp 0x101198d9
mov eax, dword [ebp - 8]
lea esp, [esp + 4]
jmp 0x100e70fb

Function at 0x10119720
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
jmp 0x10119755
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
jmp 0x1011973f

Function at 0x10119841
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x1011987d
mov word [esp], bx
mov word [esp], dx
and edx, ecx
jmp 0x1011982b
lea esp, [esp + 3]
jmp 0x1011988b
mov ebx, esi
add ebx, 8
mov edx, dword [ebx]
pop ebx
sub esp, 0x1b
jmp 0x1011984d
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
push ebx
jmp 0x10119863
push edx
mov edx, esi
add edx, 4
jmp 0x101198b3
bt edi, eax
sub edi, 0xd9ae0980
jmp 0x101199b0
mov dword [edx], edi
pop edx
dec di
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
not di
jmp 0x10119893
and edi, ecx
push esi
mov esi, edi
jmp 0x101198f0
lea esi, [esi*4]
lea esi, reloc.KERNEL32.dll_FindFirstFileA
mov edi, dword [esi]
pop esi
stc
call fcn.1011994c
pushal
ljmp 0x228b
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FindFirstFileA]
sub esp, 0xe
add esp, 7
lea esp, [esp + 3]
jmp 0x101198e5
mov edi, edx
shr edi, 0x18
push bx
mov word [esp], sp
jmp 0x10119910
Function at 0x101198ab
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
call int.101196fd
bswap ebx
stc
jmp 0x101197c3
mov dword [esi], edi
bswap edi
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
mov edi, dword [esp]
jmp 0x10119738
push edx
jmp 0x101197e8
stc
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
mov bh, al
inc bx
jmp 0x1011978d
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
and ebx, ecx
jmp 0x101197a3
and edx, ecx
jmp 0x101197f3
mov edx, esi
add edx, 9
movzx ebx, byte [edx]
pop edx
jmp 0x101197d2
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
call fcn.10119841
ljmp 0xc0cd
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
mov edx, 0x89ce83c
mov edx, ebp
mov edx, dword [esi + 4]
jmp 0x1011977d
push ebp
and edx, ecx
jmp 0x10119811

Function at 0x1011998d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x1011999a
lea esp, [esp + 1]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
jmp 0x10119977
and ebx, ecx
jmp 0x10119ac6
and edx, ecx
jmp 0x10119a2d
mov ebp, esi
add ebp, 0xd
movzx ebx, byte [ebp]
pop ebp
jmp 0x101199c0
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
call fcn.101199fc
add eax, 0xc
mov edx, dword [eax]
pop eax
jmp 0x10119a78
mov edi, edx
pushal
jmp 0x10119aa3
mov dword [esi + 8], edi
btc edi, ebp
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
lea edi, reloc.KERNEL32.dll_FindFirstFileA
jmp 0x10119a60
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FindFirstFileA]
jmp 0x10119ab0
shr edi, 0x18
stc
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x10119a8d
and edi, ecx
jmp 0x10119af0
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
sub esp, 0xc
push ebp
jmp 0x101199d6
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
lea ebx, reloc.KERNEL32.dll_FindFirstFileA
sub esp, 0x11
jmp 0x10119b15
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FindFirstFileA]
and ebx, ecx
lea esp, [esp + 0x48]
jmp 0x10119ada
mov edx, ebx
jmp 0x10119b21
lea esp, [esp + 1]
movzx ebx, byte [esi + 0xe]
stc
push edx
jmp 0x10119aff
lea edx, [edx*4]
lea edx, reloc.KERNEL32.dll_FindFirstFileA
mov ebx, dword [edx]
pop edx
jmp 0x10119bf0
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FindFirstFileA]
jmp 0x10119b94
and edx, ecx
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
call fcn.10119b72
mov dword [ecx], edi
pop ecx
lea esp, [esp + 4]
jne 0x100e7143
je 0x100e7179
aad 0x54
retf 0x5cad
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
clc
and ebx, ecx
jmp 0x10119b36

Function at 0x101199fc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
test byte [edi], dh
push ds
stc
call fcn.10119a07
jnp 0x101199d3
jns 0x10119a04
jmp 0x10119a4a
add esp, 2
lea esp, [esp + 2]
and edx, ecx
jmp 0x101199e2
retf 0xdbeb
pushal
cpuid
mov ebx, dword [esp]
mov dword [esp + 0x1c], esi
clc
popal
jmp 0x10119a39
daa
shl byte [ebp - 0x2d], cl
dec edx
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FindFirstFileA]
sub esp, 0xf
lea esp, [esp + 3]
push eax
jmp 0x10119a17
Function at 0x10119a07
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x15
add esp, 0xb
lea esp, [esp + 2]
lea esp, [esp + 0x18]
jmp 0x10119a4f

Function at 0x10119b72
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
dec dword [ebp - 4]
pushfd
push word [esp + 3]
mov dword [esp], eax
jmp 0x10119b7c
push word [esp]
lea esp, [esp + 2]
jmp 0x10119b5c
lea esp, [esp + 2]
jmp 0x10119bbd
push ecx
mov ecx, esi
lea ecx, [ecx + 0xc]
jmp 0x10119ba2

Function at 0x101c5db4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x1d]
popal
mov bp, 0x8d20
xchg byte [esp + 4], bh
std
jmp 0x101c5dbe
pop edx
pop edi
std
mov eax, edi
push dword [esp]
jmp 0x101c5d9e
xchg ebp, esi
mov dword [esp], ebp
push esi
lea ecx, [edi*4]
mov bx, cx
xchg dword [esp + 4], edi
jmp 0x101c5e0b
mov bl, 0x3a
mov word [esp + 2], bx
bswap esi
sub esp, 0x10
pop bx
xchg dl, bh
jmp 0x101c5df5

Function at 0x101c5ed4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, ebp
add edi, 0xf6652439
pop ecx
lea esp, [esp + 1]
xchg esi, eax
not bh
jmp 0x101c5eaa
lea ebp, [eax + esi]
jmp 0x101c5e8f
mov edi, 0xe07e33d0
add esp, 0
xchg byte [esp], dh
mov esi, dword [esp]
neg ah
jmp 0x101c5fc6
lea ecx, [ecx + edx]
lea ebp, [ecx - 0x2c]
call 0x101c5ed4
in eax, dx
push esp
xchg dword [esp + 5], esi
not esi
pop word [esp + 8]
jmp 0x101c5f05
not di
mov ebx, 0xea9c9bb9
sub esp, 4
mov dword [esp], edi
cpuid
rcr edx, 0x1f
jmp 0x101c5ec8
mov byte [esp + 2], ch
mov dh, 0xb0
cld
mov esi, edx
mov dh, 0x4e
cmc
jmp 0x101c5f4b
not dh
mov di, word [esp]
shr bp, cl
bsf ax, bp
xchg cl, dl
bswap ebx
jmp 0x101c5ef0
add esp, 0
xchg bx, si
setnp bh
pushal
rdtsc
mov edi, ebp
jmp 0x101c5f74
not ebx
push word [esp + 3]
pop ecx
pop dword [esp]
add esp, 4
lea ebx, [edx + edi]
jmp 0x101c5f35
mov cx, bp
rdtsc
not ax
mov byte [esp + 0xa], ch
call fcn.101c5f5e
mov byte [esp + 9], dl
pop dword [esp + 0xa]
mov byte [esp + 0xc], bl
pop esp
and al, 0xc
mov ecx, ebx
mov bp, word [esp]
lea esp, [esp]
rcr ch, 4
cpuid
clc
jmp 0x101c5f22

Function at 0x101c6729
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x4351
mov di, word [esp + 6]
mov cx, word [esp + 3]
jmp 0x101c673d
xchg byte [esp + 8], dh
pop ebp
not cx
mov cx, 0x5eb9
mov al, byte [esp + 4]
jmp 0x101c6776
lea edx, [ebx*4]
pushfd
xchg cl, bl
rdtsc
lea ebx, [eax + edi]
mov word [esp + 7], di
jmp 0x101c6760

Function at 0x101c68dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 0x19]
mov dword [esp + 0x15], ecx
not cl
inc dh
lea ebx, [esi + ebp]
mov ecx, dword [esp + 9]
call fcn.101c6866
xchg word [esp + 2], ax
xchg al, dl
jmp 0x101c68ea
mov di, 0x8290
pushal
std
setg dh
rdtsc
setno ch
jmp 0x101c6933
xchg dx, di
push word [esp + 0xb]
push di
lea ecx, [ebp*4]
pop ebp
add esp, 3
jmp 0x101c690c
pop ax
mov bh, 0x80
mov dword [esp + 7], eax
ror ax, cl
rcl ch, 1
jmp 0x101c68c4
Function at 0x101c6a41
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
xchg dword [esp], eax
pop word [esp + 1]
xchg byte [esp + 2], dh
xchg dword [esp], edi
jmp 0x101c6a4c
rdtsc
mov al, 0x42
stc
stc
cmc
xchg byte [esp + 9], ch
jmp 0x101c6a09
btc bx, ax
xchg dx, cx
adc al, ah
jmp 0x101c6a1f
xchg dword [esp], edx
mov ebp, 0xb90fc1d
xchg bp, di
sub esp, 0x1e
cmc
lea eax, [eax + edx]
jmp 0x101c6b10
mov cx, dx
rdtsc
bswap esi
call fcn.101c6a96
mov edx, 0xe457a0d3
mov cl, byte [esp + 2]
xchg byte [esp + 0xe], bh
setl bl
mov bl, 0x19
mov byte [esp + 0x19], al
jmp 0x101c6b46
pop word [esp + 0x14]
add esi, 0xbba09e3d
lea esp, [esp + 0xa]
cpuid
pushfd
mov ch, ah
jmp 0x101c6add
bsr bp, bp
cpuid
xchg byte [esp + 1], ah
mov dword [esp + 2], edi
mov word [esp + 5], di
mov ch, byte [esp + 9]
jmp 0x101c6b6b
xchg ebx, eax
neg al
xchg dword [esp + 0x14], edi
xchg ebx, eax
lea ebp, [ecx + esi]
popal
jmp 0x101c6b26
sub esp, 0x10
bswap esi
add esp, 9
lea edx, [esi*4]
jmp 0x101c6ba8
mov bp, word [esp + 4]
xchg byte [esp + 2], dh
mov ch, byte [esp]
cmc
mov dl, 0x26
dec edi
jmp 0x101c6b55
rol di, cl
xchg dl, bl
pop bp
xchg dword [esp + 7], ebp
jmp 0x101c6b92

Function at 0x101c7755
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp + 0xb], dh
pop dword [esp + 8]
mov byte [esp + 0xc], ch
pushal
jmp 0x101c7727

Function at 0x101d564d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.101c9dbf
pushal
mov word [esp + 6], sp
lea esp, [esp + 2]
mov dword [esp + 0x40], ebx
jmp 0x101d5684
push eax
push dword [esp + 1]
mov byte [esp + 2], ch
push ebp
pop dword [esp + 1]
jmp 0x101d56ce
mov dword [esp + 0x3c], esp
pushfd
push word [esp + 1]
push dword [esp + 4]
pop word [esp + 4]
mov dword [esp + 0x40], ebp
jmp 0x101d566e
pushal
mov dword [esp + 0x1e], ecx
pop word [esp + 0x18]
lea esp, [esp + 2]
jmp 0x101d589a
pop word [esp + 2]
mov word [esp + 3], bx
pop word [esp]
mov dword [esp + 0x40], esi
push dx
push bp
jmp 0x101d56b8
push eax
jmp 0x101c9dba
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x101d57b0
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x101d5828

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x401492
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
xor edi, edi
call fcn.0040b4c0
mov eax, dword [ebp + 0x1c]
add esp, 0xc
neg eax
sbb eax, eax
and eax, str.runas
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401507
cmp dword [ebp + 0x14], esi
je 0x401504
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x401520
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x401519
mov dword [eax], ecx
jmp 0x401520
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4034ac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4188e2
mov eax, dword fs:[0]
push eax
mov eax, 0x2218
call fcn.0040bdc0
mov eax, dword [0x4223b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
xor ebx, ebx
sub eax, ebx
mov esi, ecx
je 0x403614
dec eax
je 0x403511
dec eax
jne 0x40368e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40368e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.0040b4c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x221c]
call fcn.0040313e
push 0x5c
push dword [ebp - 0x221c]
mov dword [ebp - 4], 2
call fcn.0040b5b7
pop ecx
pop ecx
cmp eax, ebx
je 0x403596
sub eax, dword [ebp - 0x221c]
sar eax, 1
cmp eax, 0xffffffff
je 0x403596
lea edi, [eax + 1]
push edi
lea ecx, [ebp - 0x221c]
call fcn.004024bc
push edi
lea ecx, [ebp - 0x221c]
call fcn.0040173f
mov edi, 0x41a4ec
push edi
call fcn.0040b53a
pop ecx
push eax
push edi
lea ecx, [ebp - 0x221c]
call fcn.00402624
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2218], ax
lea eax, [ebp - 0x2216]
push ebx
push eax
call fcn.0040b4c0
add esp, 0xc
push 0xfff
lea eax, [ebp - 0x2218]
push eax
push 0x6b
push dword [0x423724]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push 1
push ebx
add esi, 0x2c
push esi
lea eax, [ebp - 0x2218]
push eax
push dword [ebp - 0x221c]
call fcn.00401492
mov ecx, dword [ebp - 0x221c]
add esp, 0x18
add ecx, 0xfffffff0
call fcn.0040124f
jmp 0x40368e
cmp dword [esi + 0x30], 1
jne 0x40362d
push ebx
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41a4e8
lea ecx, [ebp - 0x2220]
call fcn.0040313e
push str.open
lea ecx, [ebp - 0x2224]
mov dword [ebp - 4], ebx
call fcn.0040313e
lea eax, [ebp - 0x2220]
push eax
lea eax, [ebp - 0x2224]
push eax
mov byte [ebp - 4], 1
call fcn.0040317f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2224]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x2220]
add ecx, 0xfffffff0
call fcn.0040124f
push 2
mov ecx, esi
call fcn.00401b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b555
leave
ret 4
Function at 0x40491e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc
mov eax, 0x418968
call fcn.0040bc62
movzx eax, word [ebp + 8]
push 0x41a538
push eax
push dword [0x423724]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x404a08
push esi
push dword [0x423724]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4049ff
push esi
push dword [0x423724]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x14]
call fcn.0040c2f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [ebp + 8], 0
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0x34
call fcn.0040c26b
pop ecx
test eax, eax
je 0x4049d4
mov ecx, eax
call fcn.00403d7c
mov ebx, eax
jmp 0x4049d6
xor ebx, ebx
push dword [ebp + 8]
mov ecx, ebx
call fcn.004048b7
push ebx
call fcn.00403f19
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4049ff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
call fcn.0040bd3a
ret

Function at 0x404f04
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x418a02
call fcn.0040bc62
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040313e
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00404ce4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404e62
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20019
push eax
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x404f82
jle 0x404f66
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040124f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040124f
mov eax, esi
jmp 0x404fdc
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x404fc4
jle 0x404fc2
and esi, 0xffff
or esi, 0x80070000
mov edi, esi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040124f
mov eax, edi
call fcn.0040bd3a
ret
Function at 0x404fe2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x418a02
call fcn.0040bc62
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040313e
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00404ce4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404e62
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
or eax, 0x20019
push eax
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x405060
jle 0x405044
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040124f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040124f
mov eax, esi
jmp 0x4050b9
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x4050a1
jle 0x40509f
and esi, 0xffff
or esi, 0x80070000
mov edi, esi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040124f
mov eax, edi
call fcn.0040bd3a
ret

Function at 0x4050bf
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x418a48
call fcn.0040bc62
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040313e
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00404ce4
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404e62
add esp, 0xc
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
push esi
or eax, 0x20006
push eax
push esi
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x405129
jle 0x405125
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x40515d
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x40515d
jle 0x40515b
and edi, 0xffff
or edi, 0x80070000
mov esi, edi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040124f
mov eax, esi
call fcn.0040bd3a
ret