joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64928b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
cmp al, 0x2b
push esp
mov byte [esp + 2], bh
call fcn.00649206
cld
cli
popfd
insb byte es:[edi], dx
stosb byte es:[edi], al
adc dword [eax - 0x72da75ed], edx
and al, 0x40

Function at 0x6492ce
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp], ah
lea esp, [esp + 4]
jmp 0x6492b6

Function at 0x64948c
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.006494ba
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x649458
je 0x61afec
call 0x649464
dec ebp
add esp, 3
push esp
add esp, 1
jmp 0x64947f
lea esp, [esp + 4]
cmp bl, 0x2f
call 0x64948c
fisub dword [eax + 0x66]
pop dword [esp + 0xf]
lea esp, [esp + 2]
jmp 0x6494d0
lea esp, [esp + 0x20]
jne 0x61afbd
je 0x61afec
push esi
les ebx, [edx + 0x3d]
int3

Function at 0x649748
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
jbe 0x61b036
ja 0x61b088
cmp dl, 0x5a
pushal
push dword [esp + 8]
lea esp, [esp + 0x11]
lea esp, [esp + 3]
jmp 0x649634
push edx
lea esp, [esp + 8]
jmp 0x6496a8

Function at 0x649752
Capabilities:
Encrypt data using aes

Disassembly:
pushal
lea esp, [esp + 0x24]
jbe 0x648ca4
ja 0x61b04c
push ecx
jecxz 0x6497d9
push ss
in eax, 0x50
test eax, 0x2cddba24
out dx, al
rcl dword [eax - 0x2d]
hlt

Function at 0x64977a
Capabilities:
Encrypt data using aes

Disassembly:
call 0x64977a
pushal
pop word [esp + 0xf]
lea esp, [esp + 2]
jmp 0x6497a1
call fcn.0064980c
dec ebx
int 0x5d
and al, 0xd7
adc al, 0xdb
pop esi
int3
cmp cl, 0x5a
call fcn.00649752
mov byte [esp + 1], ch
jmp 0x61b051
clc
push esp
push dword [esp]
pop dword [esp]
lea esp, [esp + 4]
jmp 0x649772
lea esp, [esp + 0x20]
cmp cl, 0x61
jmp 0x6497fb
lea esp, [esp + 0x24]
jb 0x61b04c
jae 0x649793
lea esp, [esp + 0x24]
cmp cl, 0x7a
pushal
lea esp, [esp + 0x20]
jbe 0x648ca4
ja 0x648cc1
dec eax
fimul word [ebx + ebp - 0x1a]
and ch, byte [edi - 0x4b21144a]
and dword [ecx - 0x96cdc30], esi
invalid
jb 0x648cc1
pushal
mov dword [esp + 0x15], ebp
clc
call 0x6497e4

Function at 0x6497b8
Capabilities:
Encrypt data using aes

Disassembly:
call 0x64977a
pushal
pop word [esp + 0xf]
lea esp, [esp + 2]
jmp 0x6497a1
call fcn.0064980c
dec ebx
int 0x5d
and al, 0xd7
adc al, 0xdb
pop esi
int3
cmp cl, 0x5a
call fcn.00649752
mov byte [esp + 1], ch
jmp 0x61b051
clc
push esp
push dword [esp]
pop dword [esp]
lea esp, [esp + 4]
jmp 0x649772
lea esp, [esp + 0x20]
cmp cl, 0x61
jmp 0x6497fb
lea esp, [esp + 0x24]
jb 0x61b04c
jae 0x649793
lea esp, [esp + 0x24]
cmp cl, 0x7a
pushal
lea esp, [esp + 0x20]
jbe 0x648ca4
ja 0x648cc1
dec eax
fimul word [ebx + ebp - 0x1a]
and ch, byte [edi - 0x4b21144a]
and dword [ecx - 0x96cdc30], esi
invalid
jb 0x648cc1
pushal
mov dword [esp + 0x15], ebp
clc
call 0x6497e4

Function at 0x64980c
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x6499a7
cmp cl, 0x39
call fcn.006498e8
lea esp, [esp + 4]
cmp cl, 0x30
jb 0x648d3e
jmp 0x649957

Function at 0x6498e8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jbe 0x648ca4
ja 0x648d3e
Function at 0x64a312
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 3], dh
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x64a38f
push dword [esp + 2]
jmp 0x64a2f7
xor eax, eax
lea esp, [esp + 4]
jmp 0x648d25

Function at 0x64efae
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0x64efb3
jmp 0x61c76a
pushal
lea esp, [esp + 0x20]
push esp
jmp 0x64f230
mov word [esp], dx
lea esp, [esp + 3]

Function at 0x6fdb31
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
pushal
lea esp, [esp + 0x4f]
mov dl, dh
setge ah
not esi
jmp 0x6fdb17
pushal
push word [esp + 8]
xchg word [esp + 0x19], bp
mov ebp, eax
setae bh
xchg bp, dx
jmp 0x6fdaa8
mov eax, ebp
bsr bp, bp
clc
rdtsc
pop word [esp + 0xa]
xchg dword [esp + 2], edx
jmp 0x6fdac7
lea ebx, [eax - 0x4cbf754f]
mov ax, word [esp]
lea ebp, [ecx + 3]
bsf cx, ax
jmp 0x6fdb6d
not ah
xchg ebp, ecx
rdtsc
xor bx, 0x82e4
mov bl, bh
cpuid
jmp 0x6fdb00
xchg esi, edx
add esp, 0xc
lea edx, [ebx*4]
stc
lea ebx, [ecx + 0x485aa883]
jmp 0x6fdaec
bswap ebx
mov bp, bx
mov al, byte [esp]
mov cl, ch
shr eax, 1
mov edx, dword [esp]
jmp 0x6fde39
lea ecx, [ecx*4]
mov esi, dword [esp]
mov dl, dh
mov bx, word [esp]
not edi
clc
jmp 0x6fdb46
push word [esp + 1]
push edx
pop dword [esp]
lea esi, [ebx*4]
push dword [esp]
bswap edi
jmp 0x6fdb96
setg ah
not esi
btc ecx, ebx
sub esp, 4
lea ecx, [ebx + esi]
rdtsc
jmp 0x6fdbc2
cpuid
lea ebx, [edi + edi]
not dx
lea esi, [esp + esi]
btr edx, edx
lea edx, [ebx*4]
jmp 0x6fdc70
lea ecx, [esp + ecx]
mov cl, 0x2a
btc ecx, edi
xchg bp, di
xor bx, 0x7284
mov bp, dx
jmp 0x6fdd68
sub ecx, eax
lea ecx, [edi + edi]
xchg ch, dl
mov esi, 0x25c25ca0
lea edx, [ebp - 0x97]
rdtsc
jmp 0x6fddab

Function at 0x6fdddb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dl, 0x2c
pop dword [esp + 5]
btr esi, edx
lea eax, [esi*4]
mov bl, 0x40
jmp 0x6fddf0
mov word [esp + 2], dx
rcr eax, 0xd
bsf di, ax
push word [esp + 2]
cpuid
jmp 0x6fddc0
lea edx, [eax*4]
xchg dword [esp + 4], ebx
lea esp, [esp + 0x21]
lea eax, [ecx*4]
bswap ebx
mov cl, 0xd2
jmp 0x6fde21
Function at 0x6fe04a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, edx
sub esp, 0x1e
lea esi, [eax - 0x11]
mov ch, byte [esp + 0x31]
xchg dh, al
lea esi, [edi*4]
jmp 0x6fe070
cmc
xchg byte [esp + 8], cl
mov byte [esp + 0x12], ch
xchg bp, di
mov eax, 0x6436f672
cpuid
jmp 0x6fdffb
mov bp, sp
pop dword [esp + 0xc]
jmp 0x6fe024
xchg byte [esp + 0xb], al
add esp, 0x29
mov word [esp + 8], sp
setp ah
neg ch
pushal
jmp 0x6fe2e8
mov byte [esp + 0x2f], dh
mov al, 0x7e
xchg byte [esp + 0x26], dl
rdtsc
mov bl, bh
mov esi, 0xfa74db74
jmp 0x6fe053
rdtsc
sub esp, 0xe
pop dword [esp + 6]
mov bh, 0xc3
inc dl
push dword [esp + 8]
jmp 0x6fe0a9
mov edx, dword [esp + 0x16]
neg si
mov byte [esp + 0xb], ah
lea esp, [esp + 0x27]
cld
cpuid
jmp 0x6fe0cc
btr edi, esp
rdtsc
mov edx, ebp
push edx
xchg dword [esp + 0x17], ebx
xchg word [esp + 8], si
jmp 0x6fe0e8
mov dword [esp + 0x19], eax
mov dword [esp + 0xf], eax
clc
btr ebp, edx
not bp
inc bl
jmp 0x6fe137
pop word [esp + 0x17]
push word [esp + 0xa]
bsf dx, si
xchg dword [esp + 9], edi
xchg ebp, edi
mov dh, byte [esp + 0x28]
jmp 0x6fe177
setbe dh
mov cl, ch
pop bp
mov byte [esp + 0xd], dh
mov eax, dword [esp + 0x1f]
xchg word [esp + 0x23], dx
jmp 0x6fe19f
inc bl
lea ebx, [ebx + edi]
lea esi, [ecx - 0x760cc35d]
mov dl, dh
push edx
neg esi
jmp 0x6fe22c
Function at 0x6fe809
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.006fe017
pop word [esp]
push esp
lea esp, [esp + 3]
jmp 0x6fe850
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x6ff578
push eax
jmp 0x6fe012
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x6ff134
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
xor eax, eax
mov dword [0x4082a4], eax
mov dword [0x4082ac], eax
mov ecx, dword [esp + 0x50]
push ebx
push esi
mov dword [0x4082a8], eax
push edi
push ecx
call fcn.00401180
add esp, 4
test eax, eax
jne 0x401033
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
xor edi, edi
cmp dword [esp + 0x58], edi
jne 0x4010b3
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
push 0x7f00
mov dword [esp + 0x24], edi
push edi
mov dword [esp + 0x18], 0x4011e0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x24], eax
push 1
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], str.MksLmSETUP
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4010b7
push 4
mov eax, dword [0x4083b4]
push 3
push 0x7ff1
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
mov esi, dword [esp + 0x54]
push 0
mov dword [0x40819c], esi
push esi
push 0
push 0
push 0x64
push 0xc8
push 0x80000000
push 0x80000000
push 0xcf0000
push str.MksLmSETUP
push str.MksLmSETUP
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x408198], eax
test eax, eax
jne 0x401115
push 4
mov eax, dword [0x4083b4]
push 3
push 0x7ff1
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
push 0
mov dword [0x408198], eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x408198]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x34]
push 0
push 0
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push ecx
call esi
test eax, eax
je 0x401171
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x34]
push eax
call edi
lea eax, [esp + 0x34]
push eax
call ebx
lea eax, [esp + 0x34]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jne 0x401152
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
Function at 0x4014a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4014d5
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x214
ret
lea eax, [esp + 0x18]
push str.Identifier
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
lea ecx, [esp + 0x10]
lea eax, [esp + 0x11c]
lea edx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push edx
mov dword [esp + 0x1c], 0x104
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4015f6
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x18]
push eax
push ecx
call esi
push str.NEC_PC_98
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
lea ecx, [esp + 0x18]
push str.NEC_PC_98
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov byte [esp + eax + 0x20], 0
call ebx
test eax, eax
jne 0x40156c
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x214
ret
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x18]
push eax
push ecx
call esi
push str.NEC_J98
call edi
lea ecx, [esp + 0x18]
push str.NEC_J98
mov byte [esp + eax + 0x1c], 0
push ecx
call ebx
test eax, eax
jne 0x4015b1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x214
ret
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x18]
push eax
push ecx
call esi
push str.NEC_R98
call edi
lea ecx, [esp + 0x18]
push str.NEC_R98
mov byte [esp + eax + 0x1c], 0
push ecx
call ebx
test eax, eax
jne 0x4015f6
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x214
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x214
ret
Function at 0x4017d0
Capabilities:
Create service

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push 0x4082b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xc]
push str.Drivers_
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
lea ecx, [esp + 0xc]
push str.EPLPDX01.SYS
push ecx
call esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x40182e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret
push 0xf01ff
mov eax, dword [str.Eplpdx01]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x4018b5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x424
je 0x401861
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0xc]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 3
mov eax, dword [str.Eplpdx01]
push 1
push 0xf01ff
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
test ebx, ebx
jne 0x4018ab
call edi
cmp eax, 0x431
je 0x4018ab
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov dword [0x4082ac], 1
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x402dc0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x44c
lea eax, [esp]
push ebx
push esi
push edi
push ebp
push 0x4082b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [esp + 0x468]
cmp ebx, 1
jne 0x402dfa
lea eax, [esp + 0x10]
push str.Drivers_
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
jmp 0x402e00
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [esp + 0x460]
lea eax, [esp + 0x10]
push ebp
push eax
call edi
lea eax, [esp + 0x31c]
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x402e51
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x464]
push ebx
push esi
call fcn.004016d0
cmp eax, 1
je 0x402e58
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
mov esi, dword [esp + 0x464]
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402ebf
lea eax, [esp + 0x114]
push 0x4081a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x114]
push ebp
push eax
call edi
lea eax, [esp + 0x10]
push 0
lea ecx, [esp + 0x118]
push eax
push ecx
call fcn.00402ff0
add esp, 0xc
test eax, eax
jne 0x402eaa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
cmp eax, 1
je 0x402ebf
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
lea eax, [esp + 0x10]
push 0x4082b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 1
jne 0x402ee0
lea eax, [esp + 0x10]
push str.Drivers_
push eax
call edi
lea eax, [esp + 0x10]
push esi
push eax
call edi
lea eax, [esp + 0x114]
push 0x4081a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x114]
push ebp
push eax
call edi
lea eax, [esp + 0x10]
push 1
lea ecx, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
je 0x402f2d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402fce
lea eax, [esp + 0x10]
push 0x4082b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 1
jne 0x402f5e
lea eax, [esp + 0x10]
push str.Drivers_
push eax
call edi
lea eax, [esp + 0x10]
push ebp
push eax
call edi
lea eax, [esp + 0x218]
push 0x4082b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 1
jne 0x402f8d
lea eax, [esp + 0x218]
push str.Drivers_
push eax
call edi
lea eax, [esp + 0x218]
push esi
push eax
call edi
lea eax, [esp + 0x10]
push 4
push 0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
je 0x402fb6
call edi
lea eax, [esp + 0x10]
push 4
lea ecx, [esp + 0x21c]
push eax
push ecx
call esi
cmp eax, 1
je 0x402fce
call edi
mov eax, 1
pop ebp
mov dword [0x4082a4], 1
pop edi
pop esi
pop ebx
add esp, 0x44c
ret
Function at 0x403250
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push edi
xor esi, esi
push eax
mov ecx, dword [str.SYSTEMCurrentControlSetServicesEventLogSystem]
push 4
push esi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032fc
lea eax, [esp + 8]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4032ef
mov edi, dword [str._SystemRoot_System32NetMsg.dll]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [str.EventMessageFile]
mov edx, dword [esp + 8]
push eax
push edi
push 2
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push edx
call edi
test eax, eax
jne 0x4032c2
mov esi, 1
push 4
mov eax, dword [str.TypesSupported]
mov ecx, dword [esp + 0xc]
push section..rdata
push 4
push 0
push eax
push ecx
call edi
test eax, eax
je 0x4032e0
xor esi, esi
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
jmp 0x4032f5
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
push eax
call edi
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x4037c0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406008
push 0x404c94
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x407270], eax
xor eax, eax
mov al, byte [0x407271]
mov dword [0x40727c], eax
mov eax, dword [0x407270]
shr dword [0x407270], 0x10
and eax, 0xff
mov dword [0x407278], eax
shl eax, 8
add eax, dword [0x40727c]
mov dword [0x407274], eax
call fcn.00404c50
test eax, eax
jne 0x403834
push 0x1c
call fcn.00403960
add esp, 4
mov dword [ebp - 4], 0
call fcn.00404a70
call fcn.00404a60
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4084d0], eax
call fcn.00404610
mov dword [0x407250], eax
test eax, eax
je 0x403867
cmp dword [0x4084d0], 0
jne 0x403871
push 0xffffffffffffffff
call fcn.004039c0
add esp, 4
call fcn.00404390
call fcn.004042a0
call fcn.00403990
mov esi, dword [0x4084d0]
mov al, byte [esi]
cmp al, 0x22
je 0x403898
cmp al, 0x20
jbe 0x4038c5
inc esi
cmp byte [esi], 0x20
ja 0x403890
jmp 0x4038c5
inc esi
cmp byte [esi], 0x22
je 0x4038c4
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4038bf
xor eax, eax
mov al, bl
push eax
call fcn.00404240
add esp, 4
test eax, eax
je 0x4038b9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x4038a1
cmp byte [esi], 0x22
jne 0x4038c5
inc esi
cmp byte [esi], 0
je 0x4038d5
cmp byte [esi], 0x20
ja 0x4038d5
inc esi
cmp byte [esi], 0
jne 0x4038ca
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4038f9
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004039c0
jmp 0x40393a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4072ac], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x403a1e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4072a8], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4072a4], bl
jne 0x403a78
cmp dword [0x4084c8], 0
je 0x403a66
mov edi, dword [0x4084c4]
sub edi, 4
cmp edi, dword [0x4084c8]
jb 0x403a66
mov eax, dword [edi]
test eax, eax
je 0x403a5b
call eax
sub edi, 4
cmp edi, dword [0x4084c8]
jae 0x403a53
push 0x407014
push 0x407010
call fcn.00403ab0
add esp, 8
push 0x40701c
push 0x407018
call fcn.00403ab0
add esp, 8
test ebx, ebx
jne 0x403a9f
mov dword [0x4072ac], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x404610
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x407590], ebx
jne 0x40465f
call esi
cmp eax, ebx
mov edi, eax
je 0x40463d
mov dword [0x407590], 1
jmp 0x40465f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x404655
mov dword [0x407590], 2
jmp 0x40465f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x407590], 1
jne 0x40470e
test edi, edi
jne 0x404682
call esi
mov edi, eax
test edi, edi
jne 0x404682
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40469c
add esi, 2
cmp word [esi], 0
jne 0x40468a
add esi, 2
cmp word [esi], 0
jne 0x40468a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x4046fd
push ebp
call fcn.00403f10
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4046fd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4046ec
push ebx
call fcn.00403c60
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x407590], 2
jne 0x404792
test ebx, ebx
jne 0x404731
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x404731
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x404746
inc ebp
cmp byte [ebp], 0
jne 0x404738
inc ebp
cmp byte [ebp], 0
jne 0x404738
sub ebp, ebx
inc ebp
push ebp
call fcn.00403f10
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40476b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret