joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408640
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x441548]
sub esi, 1
jne 0x408680
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x4086b7
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041bde0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dc95
mov esp, ebp
pop ebp
ret 4

Function at 0x4086d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x441548]
sub edi, 1
jne 0x408750
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.0043dc95
mov esp, ebp
pop ebp
ret 4
Function at 0x40bd60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x4484a0]
mov ebx, edx
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ecx
mov edi, dword [esi + 0x3f8c]
mov eax, dword [esi + 0x4954]
or eax, 0x100
mov dword [esi + 0x498c], 1
mov dword [esi + 0x4954], eax
cmp dword [edi + 0x198], 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
jne 0x40bdbf
cmp dword [esi + 0x4ce0], 0
mov eax, 0x230
je 0x40bdc4
mov eax, 0x200
movss xmm1, dword [edi + eax]
lea ecx, [ebp - 0x24]
movss xmm2, dword [edi + eax + 4]
mov eax, dword [ebp + 8]
subss xmm2, dword [edi + 0xfc]
subss xmm1, dword [edi + 0xf8]
push dword [eax + 4]
push dword [eax]
call fcn.00414b90
mov eax, dword [ebp - 0x14]
add esp, 8
mov ecx, dword [ebp - 0x20]
or eax, 2
mov dword [esi + 0x4954], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x4978], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x4974], eax
mov dword [esi + 0x495c], 1
mov eax, dword [edi + 4]
push ebx
test ecx, ecx
je 0x40be3c
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00404e30
add esp, 0x18
jmp 0x40be50
push eax
push str._s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00404e30
add esp, 0x14
movss xmm0, dword [esi + 0x38d8]
xor edx, edx
mov ecx, dword [ebp - 0x14]
push 0x1000107
movss dword [ebp - 0x10], xmm0
call fcn.0040eb70
mov edi, dword [esi + 0x3f8c]
add esp, 4
movss xmm0, dword [ebp - 0x10]
movss dword [esi + 0x38d8], xmm0
mov byte [ebp - 9], al
cmp word [edi + 0xbc], 1
mov dword [ebp - 0x10], edi
mov dword [edi + 0x78], ebx
jne 0x40beaa
mov eax, dword [ebp - 0x18]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov dword [eax + 0xf8], ecx
mov dword [eax + 0xfc], edx
mov edi, ebx
mov edx, 0x4405a1
not edi
mov al, 0x23
mov ebx, edi
cmp al, 0x23
jne 0x40bec5
cmp byte [edx], al
jne 0x40bec5
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x441548]
test al, al
jne 0x40beb7
mov edi, dword [ebp - 0x10]
not ebx
cmp dword [esi + 0x3fdc], ebx
jne 0x40bef4
xor edx, edx
xor ecx, ecx
call fcn.00408780
mov eax, dword [ebp - 0x1c]
cmp dword [esi + 0x4a50], eax
jne 0x40bf39
cmp word [edi + 0x154], 0
jne 0x40bf12
cmp byte [edi + 0x15a], 0
je 0x40bf39
xor edx, edx
mov ecx, edi
call fcn.00411750
xor dl, dl
mov ecx, edi
call fcn.00417240
mov edx, edi
mov ecx, ebx
call fcn.00408780
mov eax, dword [esi + 0x4a7c]
mov dword [esi + 0x4000], eax
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043dc95
mov esp, ebp
pop ebp
ret
Function at 0x40c160
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40c19d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40c183
cmp byte [esi], bl
jne 0x40c183
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x441548]
test bl, bl
jne 0x40c174
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040c100
Function at 0x41a800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5e2c], 0
lea esi, [edi + 0x5e30]
je 0x41a882
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41a83c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041cb90
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.004057a0
mov edx, dword [esi]
mov ecx, 0x44849c
push dword [edi + 0x5e2c]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5e38]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.004057a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ac90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4484a0]
test bl, bl
je 0x41acd6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41acb7
cmp byte [esi], bl
jne 0x41acb7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x441548]
test bl, bl
jne 0x41aca8
mov edi, dword [0x4484a0]
mov ecx, dword [edi + 0x5dd0]
not eax
mov edx, dword [edi + 0x5dd8]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x41acfd
cmp dword [edx + 4], eax
je 0x41ad00
add edx, 0x24
cmp edx, ecx
jne 0x41acf1
xor eax, eax
ret
mov eax, edx
ret
Function at 0x42de60
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x4484a0]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42e00c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42e00c
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [0x4484a0]
add esp, 4
mov edi, eax
test esi, esi
je 0x42df03
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov ecx, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x42def9
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5edc]
test edi, edi
je 0x42df16
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42df18
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x42df53
mov esi, dword [esi + 0x74]
jmp 0x42df55
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42df78
mov dword [esi], eax
mov eax, dword [0x4484a0]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a34]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x28], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x42dfda
inc esi
cmp esi, 5
jl 0x42dfb1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dc95
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dc95
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dc95
mov esp, ebp
pop ebp
ret
Function at 0x43ba80
Capabilities:
Hash data with crc32

Disassembly:
push ecx
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov edi, edx
je 0x43baf2
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x43bac8
or edi, 0xffffffff
nop
cmp cl, 0x23
jne 0x43baaf
cmp byte [esi], cl
jne 0x43baaf
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x441548]
test cl, cl
jne 0x43baa0
mov ecx, dword [0x4484a0]
not eax
cmp dword [ecx + 0x3fdc], eax
jne 0x43bade
mov dword [ecx + 0x3fe0], eax
cmp dword [ecx + 0x4004], eax
jne 0x43bb38
mov byte [ecx + 0x4008], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x4484a0]
xor edx, edx
mov esi, dword [eax + 0x3f8c]
mov ecx, dword [esi + 0xec]
mov eax, dword [esi + 0xf4]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.00404f60
mov ecx, dword [esi]
mov ebx, eax
add esp, 4
cmp dword [ecx + 0x3fc4], ebx
jne 0x43bb36
push ecx
push edi
mov edx, 0xb
mov ecx, ebx
call fcn.0041bde0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43e593
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43e5d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43e5d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43e5d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43e5d2
cmp dword [ecx + 0x74], 0xe
jbe 0x43e5d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4059d9
Capabilities:
Parse pe header

Disassembly:
jmp 0x41be88
push 0
call dword [0x4dd05c]
test eax, eax
je 0x41bec7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bec7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41bec7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41bec7
cmp dword [ecx + 0x74], 0xe
jbe 0x41bec7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ca00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x40d410
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40cb9f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00401e65
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x40cb64
cmp dword [ebp + 0xc], 3
jbe 0x40cb64
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00402d8d
mov dword [ebp - 0x74], eax
jmp 0x40cb03
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40cb5f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40cb5a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x40cb74
jmp 0x40cb5f
jmp 0x40cb64
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.00403b6b
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x40cb91
jmp 0x40cb8c
jmp 0x40cb9f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x40ca98
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cbe0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x515e00], eax
pop esi
pop edi
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408d33
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408bef
xor esi, esi
pop ecx
cmp dword [0x425628], esi
jle 0x401046
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408bef
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401027
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0041b5b1
call fcn.0040392e
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039b0
pop ecx
pop ecx
mov esi, eax
call fcn.00403934
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x424010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42400c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x425420]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41c24c
push 0x41c23c
push dword [0x425424]
push 1
push eax
push 1
push esi
push edi
call fcn.00403472
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x403e2f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ed2
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0041b5b1
pop ecx
pop ecx
test eax, eax
je 0x403ebb
test ebx, ebx
je 0x403eaf
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0041b5b1
pop ecx
pop ecx
test eax, eax
jle 0x403ebb
push ebx
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e7c
xor edi, edi
cmp ebx, edi
jne 0x403ed6
xor eax, eax
jmp 0x403f42
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f05
call fcn.00403a18
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ed2
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ed2
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403ef5
cmp dword [ebp - 0x70], edi
je 0x403f38
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004098e8
add ebp, 0x9c
leave
ret
Function at 0x408f37
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x422550
call fcn.0040dcb0
xor esi, esi
cmp dword [0x4274a8], esi
jne 0x408df7
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x408e0a
mov dword [ebp - 0x1c], esi
jmp 0x408e40
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x408e05
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x408e05
cmp dword [eax + 0x400074], 0xe
jbe 0x408e05
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040f80c
test eax, eax
jne 0x408e51
push 0x1c
call fcn.0041b5b1
pop ecx
call fcn.0040d831
test eax, eax
jne 0x408e62
push 0x10
call fcn.0041b5b1
pop ecx
call fcn.0040dae6
mov dword [ebp - 4], esi
call fcn.0041b5b1
test eax, eax
jns 0x408e7b
push 0x1b
call fcn.0041b5b1
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4274a4], eax
call fcn.0041b5b1
mov dword [0x42565c], eax
call fcn.0041b5b1
test eax, eax
jns 0x408ea1
push 8
call fcn.0041b5b1
pop ecx
call fcn.0040f1ff
test eax, eax
jns 0x408eb2
push 9
call fcn.0041b5b1
pop ecx
push 1
call fcn.0041b5b1
pop ecx
cmp eax, esi
je 0x408ec5
push eax
call fcn.0041b5b1
pop ecx
mov eax, dword [0x425634]
mov dword [0x425638], eax
push eax
push dword [0x42562c]
push dword [0x425628]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x408ef2
push eax
call fcn.0041b5b1
call fcn.00408bb3
jmp 0x408f27
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040dcf5
ret
call fcn.0041b5b1
jmp 0x408dd6

Function at 0x4098e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4098f2
repz ret
jmp fcn.004114ed
Function at 0x41b5b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x41b5c0
pop dword [ebp - 0x24]
mov eax, 0x75e2866a
add eax, 0x8a5f2f56
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf7b57a73
add dword [ebp - 0x34], 0x569ccad8
mov dword [ebp - 0x30], 0xad6eca9e
add dword [ebp - 0x30], 0x84c481a7
mov dword [ebp - 0x2c], 0x8666a6e7
sub dword [ebp - 0x2c], 0x3a1a62b9
mov dword [ebp - 0x28], 0x7c008977
sub dword [ebp - 0x28], 0x7c008977
lea eax, [ebp - 0x34]
push eax
mov eax, 0xa45aa56a
add eax, 0x5be71ae6
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe6b51d0f
add dword [ebp - 0x34], 0x8dbd4c47
mov dword [ebp - 0x30], 0x912c5f9
add dword [ebp - 0x30], 0x38599b7c
mov dword [ebp - 0x2c], 0x4ae5787e
sub dword [ebp - 0x2c], 0xe7760c12
mov dword [ebp - 0x28], 0x1b25aea4
sub dword [ebp - 0x28], 0x1b25aea4
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x142ab7e
add eax, 0xfeff14ce
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3becf
push 0
call eax
mov ecx, 0xbb8bbbbe
add ecx, 0x44748dcd
mov ebx, eax
mov esi, 0x432a00
add esi, dword [ebp - 0x24]
mov edi, 0x300c981e
sub edi, 0x5c2b088a
xor dword [ebp - 4], 0xdcb511a4
mov edx, dword [esi]
add edx, edi
add dword [ebp - 0x18], 0xf331234d
mov dword [ebx], edx
xor dword [ebp - 4], ecx
add ebx, 0xf5c32c64
add ebx, 0xa3cd3a0
add esi, 4
loop 0x41b6dc
add eax, 0x118ff
mov ebx, eax
add eax, 0xc7cfb346
sub eax, 0xc7cfb341
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x41e7eb
Capabilities:
Reference sql statements

Disassembly:
mov dword [0x9ad9a8], 0
push 0x6fb198
push 1
push 0
call fcn.004f09d9
push 1
mov eax, str.SELECT_SVALUE_FROM_Settings_WHERE_SFIELDRegistration_expires
push eax
call fcn.004f685a
and eax, eax
je 0x41e849
push 1
call fcn.004f4ac4
and eax, eax
je 0x41e83f
push 1
push 0
call fcn.004dc9ec
mov dword [0x9ad9a8], eax
push 1
call fcn.004be154
push 1
call fcn.004d3586
mov ebx, dword [0x9ad9a8]
and ebx, ebx
jne 0x41e958
mov dword [0x9ac484], 0
push dword [0x9adfac]
call fcn.0050ecee
and eax, eax
je 0x41e92d
call fcn.004edec3
mov ebx, eax
and ebx, ebx
jne 0x41e928
push dword [0x9b3e20]
call fcn.004f0b33
lea eax, [0x9ac12c]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
push 7
push dword [0x9ac12c]
call fcn.00556870
add dword [0x9b3e20], 2
mov edx, str.Expires
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
je 0x41e923
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, 0x7000bc
push eax
push 2
push dword [0x9ac12c]
call fcn.00556db0
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.00556b90
pop dword [0x9b3e20]
mov dword [0x9ac484], eax
jmp 0x41e928
jmp 0x41e87e
call fcn.004ca5d9
mov ebx, dword [0x9ac484]
cmp ebx, 0x1404cff
jne 0x41e958
push dword [0x9ac484]
pop dword [0x9abaa4]
push dword [0x9ac484]
pop dword [0x9ad9a8]
call fcn.0041e959
ret