joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d8d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid

Function at 0x408dac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
adc byte [ebx - 0x50b6b], cl
inc dword [ebx + 0xf00307a]
test ebx, ecx
std
invalid
Function at 0x40900e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40914f
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19d4]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19d8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d60]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19dc], eax
mov dword [ebp - 0x19c], 0
jmp 0x408fb3
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x409065
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x409065
push eax
or eax, 0x2f69
sub eax, 0x8ac3
pop eax
push edx
push ebx
add esp, 4
sub edx, 0x126aa
jmp 0x408fff
call fcn.0040900e
add byte [esp + esi + 0x41], cl
push eax
inc esp
inc edx
dec eax
inc ecx
add esp, 4
pop edx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x409057
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x40905e
jmp 0x408fa4
jmp 0x409065
push esi
push ebx
add esp, 4
add esi, 0x2fc1
sub esi, 0x17012
pop esi
push eax
jmp 0x40907e
jmp 0x409084
call fcn.00409093
add byte [edi + 0x36], al
dec eax
xor al, 0x4b
inc esi
cmp al, 0x83
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x4090c4
mov dword [ebp - 0xcb8], 0
jmp 0x409133
push esi
xor esi, 0x2326
and esi, 0x1306
jmp 0x4090d7
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x16830
sub ebx, 0x100d9
xor ebx, 0x13669
and ebx, 0x12909
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x409129
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x409133
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x40914a
mov ecx, dword [ebp - 0x19dc]
mov dword [ebp - 0x510], ecx
jmp 0x40915b
jmp 0x408f34
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
Function at 0x409093
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40914f
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19d4]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19d8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d60]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19dc], eax
mov dword [ebp - 0x19c], 0
jmp 0x408fb3
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x409065
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x409065
push eax
or eax, 0x2f69
sub eax, 0x8ac3
pop eax
push edx
push ebx
add esp, 4
sub edx, 0x126aa
jmp 0x408fff
call fcn.0040900e
add byte [esp + esi + 0x41], cl
push eax
inc esp
inc edx
dec eax
inc ecx
add esp, 4
pop edx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x409057
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x40905e
jmp 0x408fa4
jmp 0x409065
push esi
push ebx
add esp, 4
add esi, 0x2fc1
sub esi, 0x17012
pop esi
push eax
jmp 0x40907e
jmp 0x409084
call fcn.00409093
add byte [edi + 0x36], al
dec eax
xor al, 0x4b
inc esi
cmp al, 0x83
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x4090c4
mov dword [ebp - 0xcb8], 0
jmp 0x409133
push esi
xor esi, 0x2326
and esi, 0x1306
jmp 0x4090d7
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x16830
sub ebx, 0x100d9
xor ebx, 0x13669
and ebx, 0x12909
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x409129
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x409133
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x40914a
mov ecx, dword [ebp - 0x19dc]
mov dword [ebp - 0x510], ecx
jmp 0x40915b
jmp 0x408f34
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
Function at 0x409664
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x40943f
invalid
invalid
add al, 0xfd

Function at 0x409688
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x9e57
pop esi
push edx
push edx
add esp, 4
add edx, 0x1133a
or edx, 0x8d4f
lea eax, [eax]
add byte [ecx + 0x109eac2], al
add byte [ecx + 0x599fea], al
add byte [edx - 0x7d], bl
mov ebp, 0xfffffd04
add byte [edi], cl
test eax, edi
or byte [eax], al
invalid
mov eax, 0x6b

Function at 0x4096a0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
xor esi, 0x9e57
pop esi
push edx
push edx
add esp, 4
add edx, 0x1133a
or edx, 0x8d4f
lea eax, [eax]
add byte [ecx + 0x109eac2], al
add byte [ecx + 0x599fea], al
add byte [edx - 0x7d], bl
mov ebp, 0xfffffd04
add byte [edi], cl
test eax, edi
or byte [eax], al
invalid
mov eax, 0x6b
Function at 0x409cac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add bl, ch
jnp 0x39213d
inc dword [ebx - 0x7a76fe40]
test al, bh
invalid

Function at 0x40a0dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
or eax, 0x10953
sub eax, 0xe6fc
xor eax, 0x2ff4
pop eax
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
leave
mov word [ebp - 0x40], cx

Function at 0x40a118
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
or eax, 0x10953
sub eax, 0xe6fc
xor eax, 0x2ff4
pop eax
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
leave
mov word [ebp - 0x40], cx

Function at 0x40a128
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
or esi, 0xd482
pop esi
push ebx
and ebx, 0x15af
xor ebx, 0xd750
pop ebx
push eax
push edi
push ebx
add esp, 4
or edi, 0x1781
jmp 0x40a130
and edi, 0x51be
and edi, 0x16a24
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x6f
or ecx, 0x152b5
pop ecx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ecx
push eax
add esp, 4
call 0x40a1b7
add byte [eax + 0x47], al
dec edx
cmp eax, 0x4c48335
or ecx, 0x5318
or ecx, 0x11f05
pop ecx
push edi
call 0x40a1d4
add byte [edx + 0x47], cl
cmp bh, byte [edx]
xor al, byte [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40a1f5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x40a24f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40a11d
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40a11d
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
invalid
Function at 0x40a1b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
or esi, 0xd482
pop esi
push ebx
and ebx, 0x15af
xor ebx, 0xd750
pop ebx
push eax
push edi
push ebx
add esp, 4
or edi, 0x1781
jmp 0x40a130
and edi, 0x51be
and edi, 0x16a24
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x6f
or ecx, 0x152b5
pop ecx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ecx
push eax
add esp, 4
call 0x40a1b7
add byte [eax + 0x47], al
dec edx
cmp eax, 0x4c48335
or ecx, 0x5318
or ecx, 0x11f05
pop ecx
push edi
call 0x40a1d4
add byte [edx + 0x47], cl
cmp bh, byte [edx]
xor al, byte [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40a1f5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x40a24f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40a11d
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40a11d
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
invalid

Function at 0x40a1d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
or esi, 0xd482
pop esi
push ebx
and ebx, 0x15af
xor ebx, 0xd750
pop ebx
push eax
push edi
push ebx
add esp, 4
or edi, 0x1781
jmp 0x40a130
and edi, 0x51be
and edi, 0x16a24
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x6f
or ecx, 0x152b5
pop ecx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ecx
push eax
add esp, 4
call 0x40a1b7
add byte [eax + 0x47], al
dec edx
cmp eax, 0x4c48335
or ecx, 0x5318
or ecx, 0x11f05
pop ecx
push edi
call 0x40a1d4
add byte [edx + 0x47], cl
cmp bh, byte [edx]
xor al, byte [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40a1f5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x40a24f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40a11d
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40a11d
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
invalid
Function at 0x424490
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4b2904
mov eax, esi
mov edx, 8
test al, 1
je 0x4244ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4244ae
shr eax, 1
dec edx
jne 0x42449f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x424498
pop esi
ret

Function at 0x4244c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4b2900], 0
jne 0x4244ee
call fcn.00424490
mov dword [esp], 0x4b2900
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x424518
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4b2904]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4244f4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x466d0c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x466d14
mov eax, edx
pop esi
pop ebx
ret
Function at 0x402c03
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x451ec9
call fcn.0043bfb1
lea ecx, [ebp - 0x1c]
call fcn.0042c7cd
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402e2f
or dword [ebp - 4], 0xffffffff
call fcn.0042c7e3
and dword [ebp - 0x18], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402d06
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402cfd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x402d06
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x402d06
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, edi
je 0x402cc9
cmp word [esi], bx
jne 0x402cc5
cmp dword [ebp - 0x20], ebx
je 0x402cbf
push dword [ebp - 0x20]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
call fcn.00402d99
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
jmp 0x402cc5
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x402c95
or dword [ebp - 4], 0xffffffff
jmp 0x402d04
mov dword [ebp - 0x18], 1
jmp 0x402d0e
call fcn.004033f1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x402d31
call fcn.0043c057
ret 4
Function at 0x4068fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40695e
cmp dword [ebp + 0xc], 1
je 0x406937
cmp dword [ebp + 0xc], 2
je 0x406937
push 0xd
pop eax
jmp 0x40695e
test edi, edi
mov eax, dword [ebp - 4]
je 0x406958
test eax, eax
je 0x406954
test al, 1
jne 0x406932
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x406958
jmp 0x406932
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x4093e0
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x451b64
call fcn.0043bf7e
and dword [ebp - 4], 0
mov edx, 0x45c744
mov ecx, 0x473b58
call fcn.00402d39
mov ebx, eax
test ebx, ebx
mov edi, 0xbdd
je 0x4095c1
mov esi, dword [ebp + 8]
push 0
push edi
call fcn.0040981f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.0040154d
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
lea ebx, [ebp - 0x10]
call fcn.00414bd6
pop ecx
mov byte [ebp - 4], 2
push 0x5c
mov esi, ebx
call fcn.00409aa4
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00409c14
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409ac5
mov byte [ebp - 4], 4
call fcn.004098e7
push 0x22
mov ecx, ebx
call fcn.004042fe
push str.__installscan
mov ecx, ebx
call fcn.00409e4e
mov edx, 0x45c770
mov ecx, 0x473b58
xor esi, esi
xor ebx, ebx
call fcn.00402d39
cmp eax, esi
je 0x4094da
push 0x45c784
push eax
call fcn.00436c2a
test eax, eax
pop ecx
pop ecx
je 0x4094da
push 3
push 5
inc ebx
call fcn.00414b63
test al, al
pop ecx
pop ecx
je 0x4094da
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.00415d04
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x409534
push 0x40
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.00436bb0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x14]
call fcn.00409b1d
push eax
neg ebx
push esi
sbb ebx, ebx
and ebx, 0x1000000
push ebx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
call fcn.00409b1d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x409534
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x30]
call ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00405628
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00405628
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x1f40
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
jne 0x40959d
mov dword [ebp - 0x18], esi
mov ebx, 0x1f4
jmp 0x40956a
xor esi, esi
cmp dword [ebp - 0x1c], esi
jle 0x40959d
add dword [ebp - 0x18], 7
push dword [ebp - 0x18]
mov esi, dword [ebp + 8]
push edi
call fcn.0040981f
sub dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x409568
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00401b5d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401b5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401b5d
mov esi, dword [ebp + 8]
push 0x5f
push edi
call fcn.0040981f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401b5d
xor eax, eax
inc eax
call fcn.0043c057
ret 8
Function at 0x40a1e2
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x453825
call fcn.0043bf7e
mov eax, dword [esi + 0xa0]
cmp eax, 1
jge 0x40a218
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.00404851
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x473988
jmp fcn.0040ea05
lea edi, [esi + 0x98]
dec eax
mov ecx, edi
call fcn.00409ce4
mov ebx, str.CFinishedPage
push ebx
mov ecx, eax
call fcn.00401e61
test eax, eax
je 0x40a242
push ebx
push dword [edi + 8]
mov ecx, edi
call fcn.004316a6
mov eax, dword [esi + 0xa0]
dec eax
lea ecx, [esi + 0x90]
cmp dword [ecx], eax
je 0x40a275
mov dword [ecx], eax
mov ecx, edi
call fcn.00409ce4
push dword [eax]
call fcn.004375d4
pop ecx
push eax
push 0
push 0x8002
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043c057
ret

Function at 0x40a27b
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x453825
call fcn.0043bf7e
lea esi, [edi + 0xa0]
mov eax, dword [esi]
cmp eax, 1
jne 0x40a2a3
cmp dword [edi + 0x90], 0
jne 0x40a2a3
push edi
call fcn.0040a3f0
mov esi, dword [esi]
cmp esi, 1
jge 0x40a2c9
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.00404851
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x473988
jmp fcn.0040ea05
dec esi
cmp dword [edi + 0x90], esi
je 0x40a2e4
push 0
push 0
push 0x8002
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043c057
ret
Function at 0x40d81c
Capabilities:
Move file

Disassembly:
push 0x20
mov eax, 0x4536f2
call fcn.0043bfb1
lea ecx, [ebp - 0x2c]
call fcn.0042c7cd
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00406380
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.004160ea
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
push 0x45d898
lea ecx, [ebp - 0x14]
call fcn.0041401c
pop ecx
pop ecx
mov esi, eax
test esi, esi
jge 0x40d896
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.004152bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b5d
or dword [ebp - 4], 0xffffffff
call fcn.0042c7e3
mov eax, esi
call fcn.0043c057
ret 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
call fcn.00419800
mov edi, eax
test edi, edi
jl 0x40d8e3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40d8be
and dword [ebp - 0x14], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x18]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401ae8
push str..exe
mov ecx, esi
call fcn.00409e4e
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.004152bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b5d
or dword [ebp - 4], 0xffffffff
call fcn.0042c7e3
mov eax, edi
jmp 0x40d88e