joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405940
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
or ebx, 0xffffffff
push eax
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], 0
mov dword [ebp - 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0xc0]
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
mov word [ebp - 0x10], dx
xor edx, edx
cmp esi, 2
mov di, ax
sete dl
mov esi, edx
mov word [ebp - 0x14], di
test esi, esi
mov word [ebp - 0x12], cx
je 0x4059bf
mov ebx, 8
jmp 0x4059e0
cmp ax, 4
jae 0x4059cc
mov ebx, 2
jmp 0x4059e0
jne 0x4059e3
cmp cx, 0xa
sbb ebx, ebx
and ebx, 0xfffffc04
add ebx, 0x400
mov dword [ebp - 0xe], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405ace
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 3
ja case.default.0x405a09
jmp dword [eax*4 + 0x405ad8]
test esi, esi
je 0x405a65
cmp di, 3
ja 0x405a23
jne 0x405a65
cmp word [ebp - 0x12], 0x32
jb 0x405a65
mov eax, dword [ebp - 0x18]
and eax, 0xffff
sub eax, 4
jns 0x405a39
mov dword [ebp - 0xa], 0xfffffffe
jmp 0x405aa4
test eax, eax
jne 0x405a46
mov dword [ebp - 0xa], 1
jmp 0x405aa4
cmp eax, 1
jne 0x405a54
mov dword [ebp - 0xa], 2
jmp 0x405aa4
sub eax, 2
neg eax
sbb eax, eax
and al, 0xfb
add eax, 4
mov dword [ebp - 0xa], eax
jmp 0x405aa4
mov eax, dword [ebp - 0x20]
sub eax, 0x182
je 0x405a30
sub eax, 0x64
je 0x405a3d
sub eax, 0x64
jne case.default.0x405a09
mov dword [ebp - 0xa], 2
jmp 0x405aa4
mov dword [ebp - 0xa], 0x40
jmp 0x405aa4
mov dword [ebp - 0xa], 0x20
jmp 0x405aa4
mov dword [ebp - 0xa], 8
jmp 0x405aa4
mov dword [ebp - 0xa], 0xffffffff
call fcn.00405af0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 6], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov cx, word [ebp - 4]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405af0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x405b09
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x405b49
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405b3f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x406130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x406238
mov esi, dword [ebp + 8]
test esi, esi
je 0x406238
cmp byte [esi], 0
je 0x406238
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x406238
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
test eax, eax
jne 0x40618c
mov ecx, dword [edi + 8]
push 0
lea eax, [ebp + 0x10]
push 0
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406238
mov eax, dword [ebp + 0x10]
dec eax
je 0x4061f8
sub eax, 3
je 0x4061cc
sub eax, 3
jne 0x406228
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406224
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.00406650
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406224
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.00406510
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406224
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.00406330
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x4090f0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0xc]
push eax
push 0
push ecx
push 0x4090c0
push 0
push 0
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x409159
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x409150
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409168
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
mov ecx, edi
call fcn.004091b0
mov ecx, dword [edi + 0xc04]
xor eax, eax
test ecx, ecx
je 0x409181
mov edx, dword [edi + 0xc08]
push edx
push ebx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x409c70
mov al, byte [0x439068]
push edi
mov byte [ebp - 0x400], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x400]
push edx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.PNCRT.dll_vsprintf]
add esp, 0xc
cmp eax, ebx
pop edi
jle 0x409c70
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
mov eax, dword [esi + 4]
lea edx, [ebp - 0x400]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a0c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a14e
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x40a14e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a14e
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
mov dword [ebp + 8], 0
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x40a14e
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40a136
mov edx, esi
cmp edi, ebx
jb 0x40a140
add edx, ebx
cmp edi, edx
jbe 0x40a159
mov edx, dword [ebp + 8]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [ebp + 8], edx
jb 0x40a128
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
inc edx
sub edi, ebx
mov dword [eax], edx
mov dword [ecx], edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a710
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x40a84f
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40a844
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x664]
test edx, edx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
je 0x40a844
lea eax, [ebp - 4]
lea ecx, [ebp - 0x664]
push eax
push 0x400
push ecx
call edx
test eax, eax
mov dword [ebp - 8], eax
je 0x40a841
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
shr eax, 2
mov dword [ebp - 4], eax
je 0x40a841
lea ebx, [ebp - 0x664]
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x264], 0x128
push eax
push 0
push 0x410
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a81e
mov edx, dword [esi + 0x10]
push str.EnumProcessModules
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
je 0x40a817
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
push ecx
push 4
push edx
push edi
call eax
test eax, eax
je 0x40a817
mov eax, dword [esi + 0x10]
push str.GetModuleBaseNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a817
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x240]
push 0x103
push ecx
push edx
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add esp, 8
inc eax
add ebx, 4
cmp eax, ecx
mov dword [ebp - 0x10], eax
jb 0x40a790
mov ebx, dword [ebp - 8]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40a8f4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Process32First
push eax
call edi
mov ecx, dword [esi + 8]
push str.Process32Next
push ecx
mov ebx, eax
call edi
test ebx, ebx
mov dword [ebp - 8], eax
je 0x40a8f4
test eax, eax
je 0x40a8f4
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13c]
lea edx, [ebp - 0x13c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call ebx
mov ebx, dword [ebp + 8]
mov edi, eax
test edi, edi
je 0x40a8bb
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
test edi, edi
je 0x40a8e9
mov eax, dword [esi]
lea edx, [ebp - 0x13c]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call dword [ebp - 8]
test eax, eax
je 0x40a8e9
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
jmp 0x40a8bf
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b070
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
mov esi, ecx
call fcn.00409a50
push str._Process_Info__r_n
push esi
call fcn.00409c00
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ProcessId:__lu_r_n
push esi
call fcn.00409c00
mov al, byte [0x439068]
mov ecx, 0xff
mov byte [ebp - 0x4b0], al
xor eax, eax
lea edi, [ebp - 0x4af]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x4b0]
push 0x400
xor ebx, ebx
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x4b0]
push edx
push str.Name:__s_r_n
push esi
call fcn.00409c00
mov dl, byte [0x439068]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xcaf]
mov byte [ebp - 0xcb0], dl
mov byte [ebp - 0xb0], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xaf]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xcb0]
lea ecx, [ebp - 0x4b0]
push eax
push 0x800
push ebx
push ecx
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b197
lea edx, [ebp - 8]
lea eax, [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0xcb0]
push 0x41070c
push ecx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b197
mov eax, dword [ebp - 4]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
lea ecx, [ebp - 0xb0]
push str._lu._lu._lu._lu
push ecx
call dword [sym.imp.PNCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0xb0]
push edx
push str.Version:__s_r_n
push esi
call fcn.00409c00
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x40b208
push str.GetProcessMemoryInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40b208
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x30]
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40b208
mov ecx, dword [ebp - 0x24]
push ecx
push str.WorkingSetSize:__lu_Bytes_r_n
push esi
call fcn.00409c00
mov edx, dword [ebp - 0x10]
add esp, 0xc
push edx
push str.PagefileUsage:__lu_Bytes_r_n
push esi
call fcn.00409c00
add esp, 0xc
push 0x411350
push esi
call fcn.00409c00
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x40b316
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
push esi
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40b36c
push esi
push 0x2001f
push 0
push edi
push ebx
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b36c
xor edx, edx
mov dword [esi], 0
test eax, eax
sete dl
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 4], 1
jne 0x40b393
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40b393
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
pop edi
test eax, eax
sete dl
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40b400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
cmp dword [ebx], 0
jne 0x40b41e
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
lea edi, [esi + 1]
push edi
call dword [sym.imp.PNCRT.dll_malloc]
mov dword [ebp - 8], edi
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x40b501
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebx]
push eax
mov eax, dword [ebp + 8]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp + 0x14]
mov ecx, ebx
push edx
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edi
call fcn.0040b5f0
cmp dword [ebp - 0x10], 1
jne 0x40b4df
cmp dword [ebp + 0x14], edi
jbe 0x40b4df
mov ebx, dword [ebp + 0x10]
mov ecx, esi
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b4a1
mov eax, dword [ebp - 8]
cmp esi, eax
jb 0x40b49a
mov esi, eax
mov eax, dword [ebp - 0xc]
push esi
push eax
jmp 0x40b4c6
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jae 0x40b4b8
mov ecx, esi
jmp 0x40b4c4
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.PNCRT.dll_strncpy]
mov eax, dword [ebp + 8]
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 4], ecx
jmp 0x40b4f4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push esi
push edx
push eax
call dword [sym.imp.PNCRT.dll_strncpy]
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.PNCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b630
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x14], ecx
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40b719
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0x2001f
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b727
push eax
push eax
mov edx, dword [ebp - 4]
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0xc]
push eax
push ecx
push eax
push eax
push eax
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40b727
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
lea esi, [eax - 1]
test esi, esi
jl 0x40b6f9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, 0x400
mov eax, dword [ebp - 4]
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push 0
lea edx, [ebp - 0x414]
push ecx
push edx
push esi
push eax
mov dword [ebp - 0x10], ebx
call edi
cmp eax, 0x103
je 0x40b6f3
test eax, eax
jne 0x40b6f0
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
call fcn.0040b630
mov dword [ebp - 8], eax
dec esi
jns 0x40b6b2
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
test eax, eax
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40cdf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ece8
push 0x40d160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.PNCRT.dll___set_app_type]
add esp, 4
mov dword [0x45fa6c], 0xffffffff
mov dword [0x45fa70], 0xffffffff
call dword [sym.imp.PNCRT.dll___p__fmode]
mov ecx, dword [0x45fa34]
mov dword [eax], ecx
call dword [sym.imp.PNCRT.dll___p__commode]
mov edx, dword [0x45fa30]
mov dword [eax], edx
mov eax, dword [sym.imp.PNCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x45fa68], ecx
call fcn.0040d150
mov eax, dword [0x4117e8]
test eax, eax
jne 0x40ce81
push 0x40d140
call dword [sym.imp.PNCRT.dll___setusermatherr]
add esp, 4
call fcn.0040d120
push 0x41002c
push 0x410028
call sub.PNCRT.dll__initterm
add esp, 8
mov edx, dword [0x45fa2c]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x45fa28]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.PNCRT.dll___getmainargs]
add esp, 0x14
push 0x410024
push section..data
call sub.PNCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.PNCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40cf8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40cef5
cmp al, 0x22
jne 0x40cee7
cmp byte [esi], 0x22
jne 0x40cefe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40cf0e
cmp al, 0x20
ja 0x40cf0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40cefe
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40cf2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40cf34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.PNCRT.dll_exit]
jmp 0x40cf74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40cefe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40cf8f
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lcall 0x4f10, 0x7da914ec
add dword [edi], 0xffffffc7
inc ebp
adc byte [esi], cl
add byte [eax], al
fst qword [eax + ecx - 0x3dcf6724]
rol dword [eax], cl
invalid

Function at 0x40a4ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
jmp 0x40a4bd
add edi, dword [ebp - 8]
nop
jmp 0x40a4d1
cmp edi, dword [ebp + 0x24]
jne 0x40a42e
jmp 0x40a4e7
nop
jmp 0x40a4f9
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x40a50a
add ebx, edx
nop
jmp 0x40a517
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
jmp 0x40a52d
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
jmp 0x40a545
add eax, edx
nop
jmp 0x40a55b
mov dword [esp + 0x24], eax
jmp 0x40a56c
pop ebx
jmp 0x40a57c
pop ebx
nop
popal
nop

Function at 0x40a5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40a345
movzx ecx, word [edx + 0x26]
nop
mov esi, dword [edx + 0x28]
jmp 0x40a35e
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
jmp 0x40a370
cmp al, 0x61
nop
jmp 0x40a383
jl 0x40a393
jmp 0x40a390
sub al, 0x20
nop
jmp 0x40a3a1
ror edi, 0xd
nop
jmp 0x40a3b0
add edi, eax
dec ecx
nop
jne 0x40a360
jmp 0x40a3c4
nop
push edx
push edi
jmp 0x40a3d7
mov edx, dword [edx + 0x10]
jmp 0x40a3e4
mov eax, dword [edx + 0x3c]
add eax, edx
nop
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x40a5cf
add eax, edx
nop
jmp 0x40a407
mov ecx, dword [eax + 0x18]
nop
push eax
nop
jmp 0x40a41c
mov ebx, dword [eax + 0x20]
add ebx, edx
nop
jmp 0x40a42e
test ecx, ecx
pop edx
nop
jmp 0x40a5df
mov edx, dword [edx]
nop
jmp 0x40a5f6
jmp 0x40a33a

Function at 0x40a77f
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40a781
ret
Function at 0x4195ab
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041975b
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4196a9
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x41964c
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x41968f
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x419663
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41967e
test al, 0x40
je 0x419675
mov ecx, dword [edi + 0x20]
jmp 0x41967c
test al, 0x80
je 0x41968f
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x41968f
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x41961b
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret