joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028dc6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10028de8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10028de8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10028de8
ret
cmp word [ebx + 4], 0x14c
jne 0x10028de8
test word [ebx + 0x16], 2
je 0x10028de8
test word [ebx + 0x16], 0x100
je 0x10028de8
cmp word [ebx + 0x18], 0x10b
jne 0x10028de8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10028de8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10028e74
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10028e08
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000fd53
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10028de8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10028e74
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10028de8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10028de8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10028de8
ret
cmp word [ebx + 4], 0x14c
jne 0x10028de8
test word [ebx + 0x16], 2
je 0x10028de8
test word [ebx + 0x16], 0x100
je 0x10028de8
cmp word [ebx + 0x18], 0x10b
jne 0x10028de8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10028de8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10028e74
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10028e08
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000fd53
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10028de8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10028f2b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10028f84
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10028f2b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10028f3a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ebdd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10028f8b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000fe01
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002902a
add edi, 4
add eax, 2
dec ecx
jne 0x10028f70
call 0x10028fd7
loope 0x10028fcd
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10029027
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10029038
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10028feb
cmp eax, ecx
ja 0x10028feb
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10029075
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002906b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100102e0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10028f3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10028f84
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10028f2b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10028f3a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ebdd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10028f8b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000fe01
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002902a
add edi, 4
add eax, 2
dec ecx
jne 0x10028f70
call 0x10028fd7
loope 0x10028fcd
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10029027
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10029038
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10028feb
cmp eax, ecx
ja 0x10028feb
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10029075
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002906b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100102e0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x408a18
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4312f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4346a4
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov dword [esi], 0x434818
push str.AD_1
mov ecx, edi
mov byte [esp + 0x20], 3
mov dword [esi + 4], ebx
call fcn.0042f97e
push 0x43a668
mov ecx, ebp
call fcn.0042f97e
push 0x439f00
lea ecx, [esi + 0x10]
call fcn.0042f97e
mov eax, 1
mov word [esi + 0x14], bx
mov word [esi + 0x16], ax
mov ecx, 0x3f800000
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x84], eax
mov byte [esi + 0x90], al
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0xa
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 0xf
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x8c], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4097d8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4313d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4346a4
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
push 0x43a668
mov ecx, edi
mov byte [esp + 0x20], 4
mov dword [esi], 0x43482c
mov dword [esi + 4], ebx
call fcn.0042f97e
push 0x43a668
mov ecx, ebp
call fcn.0042f97e
mov edi, 1
push 0x43a668
lea ecx, [esi + 0x24]
mov word [esi + 0x10], bx
mov word [esi + 0x12], di
mov dword [esi + 0x14], edi
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
mov dword [esi + 0x1c], 0xa
mov dword [esi + 0x20], edi
call fcn.0042f97e
push 0x43a668
lea ecx, [esi + 0x28]
call fcn.0042f97e
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov word [esi + 0x48], bx
mov word [esi + 0x4a], bx
mov word [esi + 0x4c], bx
mov word [esi + 0x54], bx
mov byte [esi + 0x56], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40ba40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x431836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push str.SoftwareLocal_SPCS_3000_DCSSPCS_3000_DCS_
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x128], ebx
mov dword [esp + 8], ebx
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
push 0x20019
push ebx
push ecx
push 0x80000001
mov byte [esp + 0x13c], 1
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40bbbf
mov dl, byte [0x43a668]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
push str.ClassName
push eax
mov dword [esp + 0x2c], 0x104
call edi
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.0042f97e
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
push str.IsOnline
push edx
call edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
dec eax
neg eax
sbb eax, eax
lea ecx, [esp + 0x14]
inc eax
lea edx, [esp + 0x20]
mov dword [0x43b8a8], eax
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
push str.bStartUpRun
push ecx
call edi
mov al, byte [esp + 0x20]
pop edi
cmp al, 0x59
jne 0x40bb60
mov esi, 1
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40bbbf
mov edx, dword [esp + 0xc]
push ebx
push edx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40bbbf
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], bl
call fcn.0042f8a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], 0xffffffff
call fcn.0042f8a0
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
add esp, 0x124
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], bl
call fcn.0042f8a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], 0xffffffff
call fcn.0042f8a0
mov ecx, dword [esp + 0x120]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x40d680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431b3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x84
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CDialog::CDialog
xor ebx, ebx
lea ecx, [esi + 0x6c]
mov dword [esp + 0x1c], ebx
call sub.MFC42.DLL_CString::CString
push 0x40c4c0
push 0x40c460
push 8
lea ecx, [esi + 0x90]
push 0x30
push ecx
mov byte [esp + 0x30], 1
call fcn.004301f8
lea ebp, [esi + 0x210]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x218]
mov byte [esp + 0x1c], 3
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x434e40
lea edi, [esi + 0x258]
mov byte [esp + 0x1c], 4
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x434e40
lea edi, [esi + 0x298]
mov byte [esp + 0x1c], 5
mov ecx, edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x29c]
mov byte [esp + 0x1c], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x1c], 7
call sub.MFC42.DLL_CString::CString
push 0x43a668
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], 0x434d68
call fcn.0042f97e
push 0x43a668
lea ecx, [esi + 0x29c]
call fcn.0042f97e
mov dword [esi + 0x2a0], ebx
mov dword [esi + 0x2a8], ebx
push 0x43a668
lea ecx, [esi + 0x2b0]
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2ac], ebx
call fcn.0042f97e
push edi
mov ecx, ebp
mov dword [esi + 0x2b4], ebx
mov byte [esi + 0x60], bl
call fcn.0042f8a6
lea ebx, [esi + 0x78]
mov eax, 0x55
mov ecx, 0xa5
mov edx, 0x9b
mov edi, 0xb9
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x14]
mov eax, esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4040a7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
xor eax, eax
push edi
mov ecx, 0x80070057
cmp dword [ebp + 8], ebx
jne 0x4040c1
mov eax, ecx
xor edx, edx
mov edi, 0x403214
cmp edx, edi
jne 0x4040ce
mov eax, ecx
cmp eax, ebx
jl 0x404158
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x404137
cmp eax, ebx
je 0x404109
jle 0x404145
and eax, 0xffff
or eax, 0x80070000
jmp 0x404145
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x404137
cmp eax, ebx
jne 0x4040fb
cmp dword [ebp + 8], esi
je 0x40413c
xor esi, esi
inc esi
jmp 0x404147
xor eax, eax
cmp dword [ebp - 0xc], 1
setne al
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x404155
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x40468e
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.004056e2
mov dword [ebp - 4], eax
test eax, eax
je 0x404707
and dword [ebp - 4], ebx
push 0x4031cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x4046ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4046e5
cmp eax, 0x7e
je 0x4046e5
test eax, eax
jg 0x4046d9
mov dword [ebp - 4], eax
jmp 0x404740
and eax, 0xffff
or eax, 0x80070000
jmp 0x4046d4
mov dword [ebp - 4], 0x80040641
jmp 0x404740
push 0x4031e4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x404709
mov dword [ebp - 4], 0x8000ffff
jmp 0x404735
mov eax, ebx
mov esi, dword [ebp - 8]
mov dword [edi], ebx
xor ebx, ebx
and dword [ebp - 8], ebx
mov dword [edi + 8], eax
cmp dword [edi + 4], esi
je 0x40474d
test esi, esi
je 0x404725
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov eax, dword [edi + 4]
test eax, eax
je 0x404732
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 4], esi
test ebx, ebx
je 0x404740
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40474d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x4054e2
Capabilities:
Check if file exists
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push edi
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
mov word [ebp - 8], ax
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push ebx
mov dword [0x412e2c], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
jne 0x405552
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x405658
and eax, 0xffff
or eax, 0x80070000
jmp 0x405658
cmp eax, edi
jne 0x405560
mov eax, 0x8007007a
jmp 0x405658
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040e7c5
pop ecx
pop ecx
cmp eax, ebx
jne 0x40557e
mov eax, 0x8000ffff
jmp 0x405658
push esi
add eax, 2
lea esi, [ebp - 0x220]
mov dword [ebp - 0x21c], eax
call fcn.0040568b
test eax, eax
js 0x4055b7
mov eax, dword [ebp - 0x220]
test ax, ax
je 0x4055b7
mov word [ebp - 0x10], ax
and eax, 0x3ff
or eax, 0x400
push 2
mov word [ebp - 0xe], ax
pop ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp + ebx*2 - 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov word [ebp + ebx*2 - 0xe], ax
mov eax, 0x409
mov word [ebp + ebx*2 - 0xc], ax
add ebx, 3
cmp ebx, 5
jbe 0x4055e9
mov eax, 0x8000ffff
jmp 0x405657
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
sub eax, ecx
sar eax, 1
mov esi, edi
sub esi, eax
xor edi, edi
test ebx, ebx
jle 0x405652
movzx eax, word [ebp + edi*2 - 0x10]
push 0x403774
push eax
push 0x403878
push esi
push esi
push dword [ebp - 0x21c]
call fcn.0040e7f8
add esp, 0x18
test eax, eax
js 0x405666
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x40566d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40564d
cmp eax, 3
je 0x40564d
cmp eax, 0x7e
jne 0x405676
inc edi
cmp edi, ebx
jl 0x405603
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00405bd5
leave
ret
mov eax, 0x8007007a
jmp 0x405657
mov dword [0x412e2c], eax
xor eax, eax
jmp 0x405657
test eax, eax
jle 0x405657
and eax, 0xffff
or eax, 0x80070000
jmp 0x405657
Function at 0x4056e2
Capabilities:
Check if file exists
Load windows common language runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x405725
and dword [esi], 0
and dword [ebp - 4], 0
push edi
push 0x4031cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x405733
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40572c
cmp eax, 0x7e
je 0x40572c
test eax, eax
jle 0x405721
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x405767
mov eax, 0x80004003
leave
ret
mov edi, 0x80040641
jmp 0x405767
push 0x4038a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x405748
xor edi, edi
inc edi
jmp 0x405767
lea ecx, [ebp - 4]
push ecx
push 0x4038cc
push 0x4031bc
call eax
mov edi, eax
test edi, edi
js 0x405767
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
mov dword [esi], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x405774
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
leave
ret

Function at 0x405bd5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411050]
jne 0x405bdf
repz ret
jmp fcn.004074c3
Function at 0x40a230
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406d22
and dword [ebp - 0x14], 0
cmp dword [0x412ba0], 0
mov dword [ebp - 0x18], eax
jne 0x40a2e3
push 0x402128
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a38b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40211c
push ebx
call edi
test eax, eax
je 0x40a38b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40210c
push ebx
mov dword [0x412ba0], eax
call edi
push eax
call esi
push 0x4020f8
push ebx
mov dword [0x412ba4], eax
call edi
push eax
call esi
push 0x4020dc
push ebx
mov dword [0x412ba8], eax
call edi
push eax
call esi
mov dword [0x412bb0], eax
test eax, eax
je 0x40a2e3
push 0x4020c4
push ebx
call edi
push eax
call esi
mov dword [0x412bac], eax
mov eax, dword [0x412bac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a33c
cmp dword [0x412bb0], ecx
je 0x40a33c
push eax
call esi
push dword [0x412bb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a33c
test ebx, ebx
je 0x40a33c
call edi
test eax, eax
je 0x40a333
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a333
test byte [ebp - 8], 1
jne 0x40a33c
or dword [ebp + 0x10], 0x200000
jmp 0x40a36f
mov eax, dword [0x412ba4]
cmp eax, dword [ebp - 0x18]
je 0x40a36f
push eax
call esi
test eax, eax
je 0x40a36f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a36f
mov eax, dword [0x412ba8]
cmp eax, dword [ebp - 0x18]
je 0x40a36f
push eax
call esi
test eax, eax
je 0x40a36f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412ba0]
call esi
test eax, eax
je 0x40a38b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a38d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405bd5
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x409b47
pop dword [ebp - 0x18]
mov eax, 0xb8999087
sub eax, 0xb858f540
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x616e9854
sub dword [ebp - 0x28], 0x131c5309
mov dword [ebp - 0x24], 0x5bf1298a
sub dword [ebp - 0x24], 0x29bddd45
mov dword [ebp - 0x20], 0xd6b81de8
add dword [ebp - 0x20], 0x75942646
mov dword [ebp - 0x1c], 0x4d7c2a19
sub dword [ebp - 0x1c], 0x4d7c2a19
lea eax, [ebp - 0x28]
push eax
mov eax, 0x5d3d681c
add eax, 0xa3036838
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3f2ce895
sub dword [ebp - 0x28], 0xcaba7f3f
mov dword [ebp - 0x24], 0xe4aad241
sub dword [ebp - 0x24], 0xa33e70cc
mov dword [ebp - 0x20], 0x5bd269ff
add dword [ebp - 0x20], 0x79d026d
mov dword [ebp - 0x1c], 0x98c3ca49
add dword [ebp - 0x1c], 0x673c35b7
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xb7f3fdd3
sub eax, 0xb7b32d87
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39dee
push 0
call eax
mov ecx, 0x4950
xor esi, esi
add esi, eax
mov edi, 0x1c08259e
add edi, 0xe4398a62
add edi, dword [ebp - 0x18]
mov ebx, 0x2308ff2f
add ebx, 0xaa9c683b
mov edx, dword [edi]
mov dword [ebp - 8], 0xf346dd5d
xor edx, ebx
sub dword [ebp - 0xc], 0xf3d36ae5
mov dword [esi], edx
sub dword [ebp - 0x10], edx
add esi, 4
add edi, 0xcbf6052d
add edi, 0x3409fad7
loop 0x409c65
add eax, 0x33fdc2f4
sub eax, 0x33fcaae1
mov ebx, eax
add eax, 0xd4e2a5f4
add eax, 0x2b1d5a11
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret