joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402970
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x472060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0x20]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x284], eax
movsd dword es:[edi], dword [esi]
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x18]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x54]
push eax
push fcn.00401524
mov esi, 0x104
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00407dd0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
add esp, 0x10
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0x80000000
call ebx
test eax, eax
je 0x402a0d
or eax, 0x80070000
jmp 0x402b76
push edi
mov edi, 0x402091
push edi
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00407dd0
add esp, 0x10
push 0x208
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
mov dword [ebp - 0x278], eax
je 0x402a5e
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x278]
jmp 0x402a03
push dword [ebp - 0x284]
lea eax, [ebp - 0x25c]
push edi
push esi
push eax
call fcn.00407dd0
add esp, 0x10
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x270]
call ebx
mov ebx, eax
test ebx, ebx
je 0x402aa4
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x402a03
push dword [ebp - 0x27c]
lea eax, [ebp - 0x25c]
push edi
push esi
push eax
call fcn.00407dd0
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
call ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
mov dword [ebp - 0x278], eax
je 0x402b0b
push dword [ebp - 0x270]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x274]
call esi
jmp 0x402a56
push dword [ebp - 0x280]
lea eax, [ebp - 0x25c]
push edi
push esi
push eax
call fcn.00407dd0
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
call ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push 0x405c41
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x270]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
call esi
push dword [ebp - 0x274]
call esi
test edi, edi
jle 0x402b74
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401ad8
leave
ret 0x20
Function at 0x402dc4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x4720d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x34
lea eax, [ebp - 0x160]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x164], esi
call fcn.00401977
push 0x118
lea eax, [ebp - 0x11c]
push esi
push eax
mov dword [ebp - 0x128], esi
call fcn.00401977
add esp, 0x18
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x402e78
call dword [0x409af8]
cmp eax, esi
jle 0x402e3e
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, esi
jne 0x402e49
mov ecx, 0x80004005
mov eax, dword [0x4720d0]
cmp eax, 0x4720d0
je 0x402e6e
test byte [eax + 0x1c], 1
je 0x402e6e
push ecx
push 0x402b0b
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040719c
mov eax, 0xc0000001
jmp 0x402f13
cmp dword [ebp - 0x11c], 6
jae 0x402e88
xor eax, eax
jmp 0x402f13
mov eax, dword [ebp + 0xc]
mov esi, dword [pe_dos_header]
push 4
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x12c]
push eax
push 0x21
push 0xffffffffffffffff
call esi
test eax, eax
jl 0x402f13
mov eax, dword [ebp + 0x10]
push 4
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
push eax
push 0x27
push 0xffffffffffffffff
call esi
test eax, eax
jl 0x402f13
mov al, byte [ebp + 8]
push 2
mov byte [ebp - 0x123], al
lea eax, [ebp - 0x124]
push eax
push 0x12
push 0xffffffffffffffff
mov byte [ebp - 0x124], 0
call esi
test eax, eax
jl 0x402f13
push 0x38
xor eax, eax
lea ecx, [ebp - 0x164]
inc eax
push ecx
push eax
shl edi, 0x14
push 0xffffffffffffffff
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x134], 5
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401968
leave
ret 0xc
Function at 0x402fe4
Capabilities:
Accept command line arguments
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9e8
mov eax, dword [0x47201c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x9e8], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e00
lea eax, [ebp - 0x9e4]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00403508
xor esi, esi
test eax, eax
push esi
jl 0x403186
lea eax, [ebp - 0x9e4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
mov dword [ebp - 0x9e0], eax
jne 0x403145
push 0x3e8
lea eax, [ebp - 0x9dc]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x9e8]
call fcn.004023ac
push dword [ebp + 0x14]
push dword [ebp - 0x9e8]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
push esi
mov dword [ebp - 0x9e0], eax
push esi
je 0x4030f4
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push 0x403186
push fcn.00403508
push 0xef
push esi
push 0x404e99
push esi
push dword [ebp - 0x9e0]
lea eax, [ebp - 0x9dc]
push eax
push edi
push ebx
push fcn.004090ac
push 0x2000000
call fcn.004017c8
add esp, 0x18
jmp 0x40312e
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push 0x403186
push fcn.00403508
push 0xf3
push esi
push 0x404e99
push esi
push dword [ebp + 0x18]
push edi
push ebx
push 0x404653
push 0x4000000
call fcn.004017c8
add esp, 0x14
push eax
call fcn.00408b60
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4031ce
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push 0x403186
push fcn.00403508
push 0xfa
push esi
push 0x404e99
push esi
push dword [ebp - 0x9e0]
push edi
push ebx
push 0x404fb2
push 0x2000000
call fcn.004017c8
add esp, 0x14
jmp 0x4031c8
push esi
mov dword [ebp - 0x9e0], 3
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push 0x403186
push fcn.00403508
push 0x100
push esi
push 0x404e99
push esi
push edi
push ebx
push 0x404e99
push 0x2000000
call fcn.004017c8
add esp, 0x10
push eax
call fcn.00408b60
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9e0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ba0
leave
ret 0x14
Function at 0x403283
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00404284
test eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ebx, 0x4050a4
mov edi, 0x404e99
jge 0x4032eb
push 0
push 0
call esi
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push fcn.00402fe4
push ebx
push 0xd8
push 0
push edi
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x408e18
push 0x4000000
call fcn.004017c8
add esp, 0x18
push eax
call fcn.00408b60
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
test eax, eax
push 0
push 0
jne fcn.0040334c
call esi
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push fcn.00402fe4
push ebx
push 0xde
push 0
push edi
push 0
call esi
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push fcn.004014e0
push 0x2000000
call fcn.004017c8
add esp, 0x1c
push eax
call fcn.00408b60
mov eax, 0x80004005
jmp 0x40338b

Function at 0x40334c
Capabilities:
Accept command line arguments

Disassembly:
call esi
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push fcn.00402fe4
push ebx
push 0xe3
push 0
push edi
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x404dfc
push 0x4000000
call fcn.004017c8
add esp, 0x18
push eax
call fcn.00408b60
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x403508
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], 0x40338b
mov dword [ebp - 0x24], 0x80000001
mov dword [ebp - 0x20], 0x405c41
mov dword [ebp - 0x1c], 0x80000005
mov dword [ebp - 0x18], fcn.004026dc
mov dword [ebp - 0x14], 0x80000000
mov dword [ebp - 0x10], 0x4032eb
mov dword [ebp - 0xc], 0x80000002
mov dword [ebp - 8], fcn.00406394
mov dword [ebp - 4], 0x80000003
xor ebx, ebx
mov eax, dword [ebp + ebx*8 - 0x28]
lea ecx, [ebp + 8]
push ecx
push 0x7fffffff
push eax
call fcn.00406d8c
test eax, eax
jl 0x40358f
mov esi, dword [ebp + 8]
push esi
push dword [ebp + ebx*8 - 0x28]
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
add esp, 0xc
test eax, eax
je fcn.0040218a
inc ebx
cmp ebx, 5
jb 0x40355e
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403958
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x254
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x268]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
push edi
and eax, 0x20
and ebx, 0x1f
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov dword [esp + 0x24], eax
call ebp
mov esi, dword [esp + 0x26c]
push 2
mov dword [esp + 0x20], eax
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
lea eax, [esp + 0x44]
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
push eax
push edi
call ebp
mov ebp, dword [esp + 0x48]
lea edx, [esp + 0x44]
lea ecx, [esp + 0x34]
mov eax, dword [edx]
push 0
push 0
push 0x31
mov dword [ecx], eax
mov eax, dword [edx + 8]
push edi
mov edx, dword [edx + 0xc]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4039e9
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
push 0xf
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
call ebp
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
call ebp
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x1c]
push edi
push esi
push 0x135
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x40]
push eax
mov ebp, dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
push esi
call ebp
mov ebp, dword [esp + 0x270]
test ebp, 0x10
je 0x403a7e
cmp ebx, 7
je 0x403a7e
mov eax, dword [esp + 0x40]
push 0xf00021
sub eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x3c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [esp + 0x28], eax
push 0
push 0
push 0xf2
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], 0
mov ecx, eax
and ecx, 3
mov dword [esp + 0x30], ecx
cmp ecx, 1
sbb ecx, ecx
and eax, 4
inc ecx
mov dword [esp + 0x54], eax
sar eax, 1
or eax, ecx
mov edx, eax
shl eax, 3
sub eax, edx
add eax, eax
cmp dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
jne 0x403ae5
add ecx, 2
mov eax, ecx
shl ecx, 3
sub ecx, eax
mov eax, dword [esp + 0x14]
lea edx, [eax + ecx*2]
mov dword [esp + 0x14], edx
test ebp, 0xa
jne 0x403af6
test ebx, ebx
je 0x403af6
cmp ebx, 1
jne 0x403b0b
lea eax, [esp + 0x64]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 0x24], eax
cmp ebx, 9
ja 0x405eeb
jmp dword [ebx*4 + 0x402f62]
mov eax, dword [esp + 0x2c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x10], 0
je 0x405f0a
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x254
ret
Function at 0x404468
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push 0x40278f
push fcn.00403508
push 0x108
push esi
push 0x404e99
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x4081c4
push 0x4000000
call fcn.004017c8
add esp, 0x18
push eax
call fcn.00408b60
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.004096f8
cmp eax, esi
jne 0x4044f3
cmp dword [ebp - 4], esi
je 0x4044f3
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00402fe4
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
leave
ret 0x10

Function at 0x4054d8
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x405517
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40550d
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x405519
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4054fd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4057bc
Capabilities:
Encode data using xor

Disassembly:
push 1
pop edx
cmp dword [ecx + 0x1c], edx
jbe 0x405897
push esi
push edi
lea eax, [ecx + 0x32]
movzx esi, byte [eax + 1]
movzx edi, byte [eax - 1]
mov esi, dword [esi*4 + 0x412e30]
xor esi, dword [edi*4 + 0x412630]
movzx edi, byte [eax]
add eax, 0x10
xor esi, dword [edi*4 + 0x412a30]
movzx edi, byte [eax - 0x12]
xor esi, dword [edi*4 + 0x412230]
mov dword [eax - 0x12], esi
movzx esi, byte [eax - 0xb]
movzx edi, byte [eax - 0xc]
mov esi, dword [esi*4 + 0x412e30]
xor esi, dword [edi*4 + 0x412a30]
movzx edi, byte [eax - 0xd]
xor esi, dword [edi*4 + 0x412630]
movzx edi, byte [eax - 0xe]
xor esi, dword [edi*4 + 0x412230]
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
movzx edi, byte [eax - 8]
mov esi, dword [esi*4 + 0x412e30]
xor esi, dword [edi*4 + 0x412a30]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x412630]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x412230]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x412e30]
xor esi, dword [edi*4 + 0x412a30]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x412630]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x412230]
inc edx
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x1c]
jb 0x4057cd
pop edi
pop esi
ret
Function at 0x406394
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x4063ab
push 0xfffffffffffffffb
jmp 0x4064ad
cmp dword [edi + 8], 1
je 0x4063b8
push 0xfffffffffffffffa
jmp 0x4064ad
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x406513
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x406513
push 0x10
pop esi
cdq
mov ecx, esi
idiv ecx
test edx, edx
jne 0x4064ab
mov eax, dword [ebp + 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [edi + 4]
sub eax, 0
mov dword [ebp + 8], ecx
je 0x4064b0
dec eax
je 0x406400
or eax, 0xffffffff
jmp 0x406515
lea eax, [edi + 0xc]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409750
mov eax, dword [ebp + 8]
add esp, 0xc
dec eax
test eax, eax
jle 0x406465
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push ebx
call fcn.00407404
mov eax, dword [ebp - 0x20]
push esi
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00409750
lea eax, [ebp - 0x10]
push esi
push eax
push dword [ebp + 0x10]
call fcn.00409750
add dword [ebp + 0x10], esi
add esp, 0x18
add ebx, esi
dec dword [ebp + 0xc]
jne 0x40641c
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push ebx
call fcn.00407404
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
movzx edi, byte [ebp - 1]
test edi, edi
jle 0x4064ab
cmp edi, esi
jg 0x4064ab
mov ecx, esi
sub ecx, edi
mov eax, ecx
cmp eax, esi
jge 0x4064f9
movzx edx, byte [eax + ebp - 0x10]
cmp edx, edi
jne 0x4064ab
inc eax
jmp 0x40649b
push 0xfffffffffffffff9
pop eax
jmp 0x406515
lea eax, [ecx - 1]
test eax, eax
jle 0x4064cf
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
mov ecx, edi
push ebx
call fcn.00407404
add dword [ebp + 0x10], esi
add ebx, esi
dec dword [ebp + 0xc]
jne 0x4064ba
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push ebx
call fcn.00407404
movzx edi, byte [ebp - 1]
cmp edi, esi
jge 0x4064ab
mov ecx, esi
sub ecx, edi
mov eax, ecx
cmp eax, esi
jge 0x4064f9
movzx edx, byte [eax + ebp - 0x10]
cmp edx, edi
jne 0x4064ab
inc eax
jmp 0x4064e9
lea eax, [ebp - 0x10]
push ecx
push eax
push dword [ebp + 0x10]
call fcn.00409750
mov eax, dword [ebp + 8]
add esp, 0xc
shl eax, 4
sub eax, edi
jmp 0x406515
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x406b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [0x4132a8]
mov eax, dword [str.cw]
push 0x4723c0
sub ecx, eax
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [0x4d10fc], 0x4132b0
mov dword [0x472474], 0x472478
mov dword [ebp - 8], 0x927
mov dword [ebp - 4], 0x28d7
mov eax, dword [ebp - 4]
cmp word [ebp - 8], ax
jne 0x406b62
call fcn.00404b1b
mov dword [ebp - 0x14], 0x47244b
lea eax, [ebp - 8]
mov dword [0x4d3818], eax
mov ax, word [0x4d3820]
xor eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
or cl, 0xfc
add ecx, dword [ebp - 8]
mov ax, word [0x4d381c]
imul ax, ax, 0x11c
xor ecx, eax
mov word [0x4d381c], cx
mov word [0x4d3820], 0
and dword [0x4d3824], 0
movsx eax, word [0x4d381c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
xor ecx, 0x34
xor eax, 0xfffffff8
cmp eax, ecx
mov dword [ebp - 0xc], eax
jbe 0x406be0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00405154
mov word [0x4d3820], ax
movzx eax, word [0x4d3820]
mov dword [0x4d3824], eax
push dword [0x472474]
push dword [0x4d10fc]
mov eax, dword [ebp - 0x14]
call eax
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xffffac38
mov dword [ebp - 0x10], 0xbc
movsx eax, word [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jne 0x406c1b
call fcn.00408a83
leave
ret

Function at 0x406d54
Capabilities:
Accept command line arguments
Set registry value

Disassembly:
push ebx
push ebx
call edi
push eax
call sub.KERNEL32.DLL_GetCommandLineA
push eax
push esi
push 0x4050a4
push 0x225
push ebx
push 0x404e99
push ebx
push dword [ebp - 0x1778]
push dword [ebp - 0x1788]
push fcn.004090ac
push 0x2000000
call fcn.004017c8
add esp, 0x10
push eax
call fcn.00408b60
mov dword [ebp - 0x1780], 0x80004005
mov edi, edi
push esi
mov esi, eax
xor eax, eax
test edx, edx
mov ecx, edx
je 0x406d6f
cmp word [esi], ax
je 0x406d6b
inc esi
inc esi
dec edx
jne 0x406d61
test edx, edx
jne 0x406d74
mov eax, 0x80070057
test edi, edi
pop esi
je 0x405059
test eax, eax
jl fcn.00402fe4
sub ecx, edx
mov dword [edi], ecx
ret
Function at 0x4071c4
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47201c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
mov dword [ebp - 0x270], eax
jl 0x407331
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [fcn.00409a90]
test eax, eax
mov dword [ebp - 0x270], eax
jl 0x407331
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x54]
push eax
mov edi, esi
shl edi, 5
push dword [edi + 0x471ff8]
lea eax, [ebp - 0x25c]
push 0x40355e
push 0x104
push eax
call fcn.00407f0c
add esp, 0x14
test eax, eax
mov dword [ebp - 0x270], eax
jl 0x40732f
inc esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [ebp - 0x274], esi
jmp 0x407315
cmp dword [ebp - 0x270], 0
jl 0x40732e
push 0x4d392c
push dword [esi + 0x471ffc]
call ebx
test eax, eax
je 0x4072aa
push dword [esi + 0x471ffc]
lea eax, [ebp - 0x25c]
push eax
push dword [esi + 0x471ff4]
push dword [ebp - 0x278]
call fcn.00404468
jmp 0x407303
lea eax, [ebp - 0x27c]
push eax
push dword [esi + 0x471ff4]
push dword [ebp - 0x278]
call fcn.004090ac
test eax, eax
jne 0x4072f7
cmp dword [ebp - 0x27c], 1
jne 0x407303
push 1
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [esi + 0x471ffc]
push dword [edi + 0x471ff8]
call fcn.00402fe4
test eax, eax
jle 0x407303
and eax, 0xffff
or eax, 0x80070000
inc dword [ebp - 0x274]
mov esi, dword [ebp - 0x274]
mov dword [ebp - 0x270], eax
push dword [edi + 0x4d3878]
shl esi, 5
push dword [esi + 0x4d3878]
call ebx
test eax, eax
je 0x40726c
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x270]
xor ecx, ebp
call fcn.00408ba0
leave
ret 8