joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41419d
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4264f0
call fcn.00424100
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.00412e56
push 1
mov ecx, esi
call fcn.004137ad
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.0040f7a7
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.00402125
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x50]
call fcn.0041432c
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0041432c
lea eax, [esi + 0x1e4]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1ac], ebx
lea ebx, [esi + 0x1b4]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.0041435d
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.0041435d
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x4142b0
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x203], 1
jne 0x4142a6
push 0x427e10
lea ecx, [ebp - 0x50]
call fcn.004026d9
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x4142db
cmp byte [ebp - 0xd], 0
jne 0x4142f1
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x203], 1
je 0x41430a
cmp dword [ebp - 0x34], ebx
jne 0x4142d4
push 0x427e10
lea ecx, [ebp - 0x38]
call fcn.004026d9
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x41430a
cmp byte [esi + 0x136], 0
jne 0x41430a
mov ecx, esi
mov byte [esi + 0x135], 1
call fcn.004146fa
jmp 0x414313
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.00412d0f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414d1f
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x4166d9
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xfffffffc
xor eax, eax
add eax, esp
mov dword [eax], ebp
push edi
pop eax
mov ecx, eax
push ecx
mov ecx, ebx
xchg edx, ecx
add esp, 0xfffffffc
mov dword [esp], edx
add esp, 0xfffffffc
mov edx, esp
xchg edx, ebx
mov dword [ebx], esi
mov ebx, 0x1eab320e
add ebx, 0x18
push ebx
mov ebx, 0x7ba508e9
mov ecx, ebx
shr ecx, 2
pop eax
xor ecx, eax
lea edi, [ecx]
mov ebx, 0x45
inc ebp
add byte [eax], al
add byte [ebx], ch
sti
mov edx, dword [edi + 0x45]
sub ecx, ecx
add ecx, dword [edx]
mov edx, 0x13e0d56e
shr edx, 7
add edx, 0x7014770a
xor ecx, edx
push 0x20312266
mov edi, 0xf4a3577
shr edi, 7
pop esi
xor edi, esi
xor ecx, edi
mov edx, 0x3b7cb19
mov eax, edx
shr eax, 7
xor esi, esi
add esi, 0x76f96
xor esi, eax
add ecx, esi
je 0x416846
mov ecx, 0xc25b510
add ecx, 0xffffff8b
invalid
mov edi, edi
invalid
invalid
push ecx
xor edi, edi
add edi, 0x6c5c1c45
shr edi, 3
mov ebx, 0xdc8b241
xor ebx, edi
xor esi, esi
add esi, dword [ebx]
mov ecx, 0x4323ac90
shr ecx, 2
add ecx, 0x248f44ce
xor esi, ecx
xor eax, eax
add eax, esi
mov dword [esp - 0x14], 0
xor dword [esp - 0x14], eax
pop eax
mov ecx, 0xffffffff
add eax, ecx
mov edx, eax
xchg edi, edx
mov ecx, 0xfffffffc
add esp, ecx
mov dword [esp], edi
add eax, 0
je 0x416750
xor ebx, ebx
or ebx, 0x10110c02
xor edi, edi
add edi, 0x2807264
xor ebx, edi
jmp 0x4166df
xor ecx, ecx
add ecx, dword [esp]
mov eax, 0xfffffffc
sub esp, eax
mov esi, 0x40
add esi, 0
push esi
mov ebx, 0xfd9
add ebx, 0x27
push ebx
mov eax, 0x373
sub eax, 0x51
push eax
mov esi, 0x60
add esi, 0xffffffa0
push esi
xor ebx, ebx
sub ebx, 0xffbdffec
xor ecx, ecx
add ecx, 0x7008
xor ebx, ecx
mov edi, dword [ebx]
mov eax, edi
xor ebx, ebx
add ebx, eax
call ebx
mov esi, eax
push esi
pop ebx
push ebx
pop eax
sub esp, 4
mov ecx, esp
mov dword [ecx], eax
xor eax, eax
add eax, 0x3db8420a
shr eax, 2
mov edx, 0xf2f3fbd
xor eax, edx
mov edx, 0
xor edx, dword [eax]
mov esi, edx
xchg esi, ecx
mov edx, 0x167092ea
shr edx, 6
add edx, 0x6fe27669
xor ecx, edx
mov dword [ebx], ecx
mov ecx, 0
mov edx, 4
xor ecx, edx
lea ebx, [ebx + ecx]
mov ecx, 0x3ad1b7c0
mov edx, 0xc52e483c
xor ecx, edx
sub eax, ecx
xor ecx, ecx
or ecx, 0x336a9a12
shr ecx, 6
mov edx, 0x8c7811
sub ecx, edx
xor ecx, eax
mov esi, 0xa6f8993
add esi, 0x15
push esi
xor edi, edi
or edi, 0x14df1350
shr edi, 1
pop edx
xor edi, edx
add ecx, edi
jne 0x4167ce
pop ebx
call ebx
mov eax, esp
sub eax, 0xffffffd8
mov esi, dword [eax - 0x28]
add esp, 4
xor ebx, ebx
add ebx, dword [esp]
add esp, 4
pop ebp
xor edi, edi
add edi, dword [esp]
mov eax, 0xfffffffc
sub esp, eax
mov ecx, 0x4240a7
add ecx, 0x59
push ecx
lea esp, [esp + 4]
jmp dword [esp - 4]
Function at 0x422970
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x422e60
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x422e95
jmp 0x422e80
and edi, 0x3f
jne 0x422e8b
push esi
call fcn.004229b0
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x422e80
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.004229b0
xor eax, eax
mov ecx, dword [esi + eax*4]
bswap ecx
mov dword [ebp], ecx
inc eax
add ebp, 4
cmp eax, 8
jb 0x422eb7
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x422f50
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x422f78
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x422f87
mov eax, 1
ret 4
Function at 0x40392d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x4190]
mov eax, 0x4210
call fcn.0040d010
mov eax, dword [0x410120]
xor eax, ebp
mov dword [ebp + 0x418c], eax
push ebx
push esi
mov esi, dword [ebp + 0x4198]
push edi
mov edi, dword [ebp + 0x419c]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], edi
call fcn.00406d2d
test eax, eax
je 0x403a16
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x2000
push eax
call dword [sym.imp.MSVCR80.dll__vsnwprintf_s]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4039d4
push 0x100
lea eax, [ebp + 0x3f8c]
push eax
push 0x7b
call fcn.004038c6
test eax, eax
je 0x4039d4
lea eax, [ebp + 0x3f8c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4039a9
sub eax, edx
sar eax, 1
lea ecx, [ebp + 0x3f8c]
push ecx
inc eax
push eax
add eax, eax
lea ecx, [ebp + 0x3f8c]
sub ecx, eax
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4039da
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, esi, 3
mov eax, esi
call fcn.0040d040
mov ebx, esp
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
call fcn.00406fe7
jmp 0x403aa7
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x403a1b
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, esi, 3
mov eax, esi
call fcn.0040d040
mov edi, esp
xor ebx, ebx
push ebx
push ebx
dec esi
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x78]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
call fcn.00406fe7
mov eax, edi
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403a58
sub eax, ecx
je 0x403a88
cmp byte [esi + edi], 0x25
jne 0x403a75
cmp byte [esi + edi + 1], 0x73
jne 0x403a75
mov byte [esi + edi + 1], 0x53
mov eax, edi
inc esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403a7b
sub eax, ecx
cmp esi, eax
jb 0x403a63
mov esi, 0x400
mov eax, esi
call fcn.0040d040
mov ebx, esp
push dword [ebp - 0x7c]
push edi
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.MSVCR80.dll__vsnprintf_s]
add esp, 0x14
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403aac
push 0
lea ecx, [ebp - 0x80]
push ecx
sub eax, edx
push eax
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418c]
xor ecx, ebp
call fcn.0040cff7
add ebp, 0x4190
leave
ret 8
Function at 0x403e3d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0xfffffffffffffff6
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403e9b
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x403e9b
mov eax, dword [ebp - 8]
and eax, 0xfffffffb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x403e9b
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403ea2
call esi
mov dword [ebp - 4], eax
jmp 0x403ebb
mov eax, dword [ebp - 0xc]
jmp 0x403eb8
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x403eb4
cmp cl, 0xd
jne 0x403eb8
mov byte [eax + edi], 0
dec eax
jns 0x403ea7
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
jne 0x403ecd
call esi
jmp 0x403edb
push 0x4013d8
call fcn.00403aec
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404ddb
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x40d7d4
call fcn.0040d0f4
xor edi, edi
push edi
push 0x8000080
push 3
push edi
xor esi, esi
inc esi
push esi
push 0x80000000
push dword [ebp + 8]
call fcn.004073af
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
cmp eax, 0xffffffff
je 0x404e11
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0xffffffff
jne 0x404e3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00404dbd
mov eax, edi
call fcn.0040d193
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], edi
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
je 0x404e5a
mov edi, 0x80004005
jmp 0x404e26
push eax
call fcn.00407ec1
cmp eax, edi
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jne 0x404e6f
push 0xe
pop edi
jmp 0x404e26
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [esi]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404e1e
jmp 0x404e26

Function at 0x404e86
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x40d807
call fcn.0040d0f4
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call fcn.004073af
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
cmp eax, 0xffffffff
je 0x404ebd
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0xffffffff
jne 0x404ee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404dbd
mov eax, esi
call fcn.0040d193
ret 0xc
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404eca
jmp 0x404ed2
Function at 0x404f20
Capabilities:
Read file via mapping

Disassembly:
push 0x18
mov eax, 0x40d85d
call fcn.0040d0f4
or dword [ebp - 0x24], 0xffffffff
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 2
push 3
pop eax
push esi
push esi
push eax
push esi
xor ebx, ebx
inc ebx
push ebx
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call fcn.004073af
mov edi, eax
cmp dword [ebp - 0x20], esi
je 0x404f6f
cmp dword [ebp - 0x24], esi
je 0x404f6c
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x40501d
push esi
push edi
mov dword [ebp - 0x20], ebx
call fcn.00403870
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40501d
push esi
push esi
push esi
push 2
push esi
push dword [ebp - 0x24]
call fcn.004078fa
cmp eax, esi
mov dword [ebp - 0x1c], eax
je 0x40501d
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x405014
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push ebx
call fcn.0040837d
mov edi, eax
cmp edi, esi
je 0x40500d
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push ebx
push edi
call fcn.004041ac
cmp dword [ebp - 0x10], esi
je 0x40500d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push ebx
push edi
call fcn.0040414d
cmp dword [ebp + 8], esi
je 0x40500d
cmp dword [ebp - 0x18], esi
je 0x40500d
mov eax, dword [ebp - 0x10]
test byte [eax + 0x10], 8
push 0
pop eax
setne al
inc eax
mov dword [ebp - 0x14], eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00404dbd
mov eax, dword [ebp - 0x14]
call fcn.0040d193
ret 4
Function at 0x40537a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00404ddb
xor ebx, ebx
cmp eax, ebx
je 0x4053b2
push ebx
push eax
call fcn.00403b6e
push eax
push dword [ebp + 8]
push 0x1c
call fcn.00403b19
add esp, 0xc
xor al, al
jmp 0x40553d
push esi
mov esi, dword [ebp - 4]
cmp esi, ebx
jne 0x4053cd
push dword [ebp + 8]
push 0xc
call fcn.00403b19
pop ecx
pop ecx
xor al, al
jmp 0x40553c
imul esi, esi, 5
lea eax, [esi + 2]
push edi
push eax
call fcn.00407ec1
mov edi, eax
cmp edi, ebx
pop ecx
je 0x405486
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x40541f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
movzx eax, byte [ecx + eax]
push eax
mov eax, esi
sub eax, ebx
inc eax
inc eax
push 0x401684
push eax
lea eax, [ebx + edi]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x10
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 5
cmp eax, dword [ebp - 4]
jb 0x4053ed
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov byte [edi + esi - 2], 0xd
mov byte [edi + esi - 1], 0xa
je 0x405470
push esi
push edi
push ebx
call fcn.00404e86
test eax, eax
je 0x405455
push 0
push eax
call fcn.00403b6e
push eax
push ebx
push 0x14
call fcn.00403b19
add esp, 0xc
jmp 0x405515
cmp byte [0x410160], 0
jne 0x405539
push ebx
push 0x72
call fcn.00403b19
pop ecx
jmp 0x405538
lea eax, [esi + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp + 8], eax
jne 0x405492
push 0xd
call fcn.00403b19
jmp 0x405514
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov ebx, eax
push edi
push ebx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push dword [ebp + 8]
mov byte [ebx + esi + 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4054d3
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403b6e
push eax
push 0xf
jmp 0x40550e
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4054ef
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403b6e
push eax
push 0xe
jmp 0x40550e
push dword [ebp + 8]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x405519
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403b6e
push eax
push 0x10
call fcn.00403b19
pop ecx
pop ecx
xor al, al
jmp 0x40553b
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp byte [0x410160], 0
jne 0x405539
push 0x71
call fcn.00403b19
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406f52
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push 0
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esi]
cmp ecx, 1
je 0x406f81
cmp ecx, 7
je 0x406f81
cmp ecx, 2
jne 0x406f96
test eax, eax
jne 0x406f96
test edi, edi
je 0x406f96
mov ecx, dword [edi]
test ecx, ecx
je 0x406f96
lea eax, [ecx + ecx]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x4074f7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp dword [0x410008], esi
je 0x40752a
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x407601
push esi
push 1
push esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.00407122
test eax, eax
jge 0x40754c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4075ed
push ebx
mov ebx, dword [ebp + 0x1c]
cmp ebx, esi
push edi
jbe 0x4075d2
cmp dword [ebp + 0x14], esi
jbe 0x4075d2
cmp dword [ebp + 0x14], 2
jbe 0x4075b6
cmp dword [ebp + 0x14], 7
jne 0x4075d2
push esi
push esi
push esi
push esi
push ebx
push dword [ebp + 0x18]
push esi
push esi
call fcn.00406fe7
mov edi, eax
cmp edi, esi
je 0x40758f
push 0x4017b4
push edi
call fcn.00407f0b
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x407594
push 8
pop esi
jmp 0x4075eb
push esi
push esi
push edi
push eax
push ebx
push dword [ebp + 0x18]
push esi
push esi
call fcn.00406fe7
cmp eax, esi
jne 0x4075af
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4075e9
mov ecx, dword [ebp - 4]
mov ebx, eax
jmp 0x4075d5
push esi
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
call fcn.00407122
test eax, eax
jl 0x4075a7
mov ecx, dword [ebp - 4]
shr ebx, 1
jmp 0x4075d5
mov ecx, dword [ebp + 0x18]
push ebx
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
pop edi
pop ebx
push dword [ebp - 8]
call fcn.00407f4c
push dword [ebp - 4]
call fcn.00407f4c
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret 0x18
Function at 0x407708
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x410120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
cmp dword [0x410008], ebx
je 0x40774b
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x40785c
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
call fcn.00407122
test eax, eax
jl 0x407850
cmp dword [ebp + 0x14], ebx
jne 0x40776f
lea eax, [ebp - 0x14]
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x18], ebx
jne 0x40778d
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00406f52
jmp 0x40784d
mov edi, dword [ebp + 0x1c]
mov esi, dword [edi]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4077da
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 1
je 0x4077c7
cmp eax, 7
je 0x4077c7
cmp eax, 2
jne 0x407850
cmp dword [ebp - 8], 0x7a
je 0x4077d6
cmp dword [ebp - 8], 0xea
jne 0x407850
shl dword [edi], 1
jmp 0x407850
mov ecx, dword [edi]
cmp ecx, ebx
mov dword [ebp - 0x10], ecx
je 0x407850
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 1
je 0x4077f7
cmp eax, 7
je 0x4077f7
cmp eax, 2
jne 0x407850
push ebx
push ebx
push ecx
push dword [ebp + 0x18]
push ebx
push ebx
call fcn.00406f9c
cmp eax, ebx
je 0x407847
add eax, eax
cmp esi, eax
mov dword [edi], eax
jae 0x407819
mov dword [ebp - 8], 0x7a
jmp 0x407850
mov eax, dword [ebp - 0x10]
call fcn.0040d040
mov edi, esp
push dword [ebp - 0x10]
push dword [ebp + 0x18]
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
shr esi, 1
push esi
push dword [ebp + 0x18]
push dword [ebp - 0x10]
push edi
push ebx
push ebx
call fcn.00406f9c
test eax, eax
jne 0x407850
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call fcn.00407f4c
mov eax, dword [ebp - 8]
pop ecx
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cff7
leave
ret 0x18

Function at 0x40837d
Capabilities:
Parse pe header

Disassembly:
push 0x10
push 0x40e3e0
call fcn.0040d06c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x4083ed
cmp eax, 0xffffffff
je 0x4083ed
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
cmp word [eax], 0x5a4d
jne 0x4083e6
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x4083e6
lea edx, [ecx + 0x18]
cmp edx, dword [ebp + 0xc]
jae 0x4083e6
mov edx, ecx
lea edi, [edx + 0x18]
cmp edi, edx
jb 0x4083e6
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
je 0x4083e6
mov dword [ebp - 0x1c], esi
jmp 0x4083e6
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.0040d0b1
ret 8
Function at 0x4083f8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [esp + 0x10]
movzx esi, word [ecx + 6]
movzx eax, word [ecx + 0x14]
xor ebx, ebx
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x408443
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40841e
cmp dword [eax + 0x14], edi
ja 0x408443
mov edx, dword [eax + 0x10]
mov ecx, edi
sub ecx, dword [eax + 0x14]
cmp edx, ecx
ja 0x408443
mov ecx, dword [eax + 0xc]
cmp dword [esp + 0x14], ecx
jb 0x40843b
add ecx, edx
cmp dword [esp + 0x14], ecx
jb 0x408445
add eax, 0x28
inc ebx
cmp ebx, esi
jb 0x408415
xor eax, eax
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x40cff7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410120]
jne 0x40d001
repz ret
jmp fcn.0040d57a