joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4667e1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00412f40
add esp, 0xc
mov eax, 1
lea ecx, [ebp - 0x4c]
push ecx
push 0
push esi
mov dword [ebp - 0x4c], 0x7c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
call fcn.004111c1
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x466844
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
push 0
mov ecx, edi
call fcn.00403b70
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
push 0
lea ecx, [edi + 0x10]
call fcn.00403b70
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
push 0
lea ecx, [edi + 0x20]
call fcn.00403b70
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
push 0
lea ecx, [edi + 0x30]
call fcn.00403b70
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
lea esi, [edi + 0x40]
push 0
mov ecx, esi
call fcn.00403b70
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
lea ecx, [edi + 0x50]
push 0
call fcn.00403b70
lea eax, [edi + 0x50]
push eax
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0044cde9
push eax
lea esi, [edi + 0x60]
call fcn.0040e0a0
lea ecx, [ebp - 0x10]
call fcn.00402250
mov ax, word [ebp - 0x34]
mov word [edi + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [edi + 0x74], eax
dec eax
je 0x4668fc
dec eax
je 0x4668ea
mov dword [edi + 0x70], 3
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x70], 2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x70], 1
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x466a4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0xd0], 0
je 0x466a8d
test al, al
je 0x466a8d
lea eax, [esi + 0xd4]
push eax
call fcn.004319f5
push esi
push 0
push 0x466a39
call fcn.00415214
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
pop ecx
pop ebp
ret 8
push eax
push esi
call fcn.0046690e
pop esi
pop ecx
pop ebp
ret 8
Function at 0x46888b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov al, byte [0x4974e7]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x8000
push edi
mov byte [ebp - 4], al
call fcn.00414139
add esp, 4
push eax
call fcn.0041404e
add esp, 8
mov esi, eax
push ebx
mov dword [ebp - 8], esi
call fcn.00443d61
test al, al
je 0x4688e8
push edi
push ebx
call fcn.00443106
push eax
push 1
push ebx
call fcn.004680ed
push eax
call fcn.004142b6
add esp, 0x10
mov ebx, eax
jmp 0x468933
push esi
jmp 0x468946
lea esi, [ebp - 0x1c]
call fcn.0040d370
push ebx
call fcn.004533eb
push esi
push eax
call fcn.0045f645
mov edx, dword [ebp - 0x1c]
push edx
push 0x487e30
push edi
call fcn.00414330
add esp, 0xc
cmp byte [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x468925
push ebx
call fcn.0045340c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0x1c]
call fcn.00401350
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push edi
call fcn.004145c6
add esp, 4
cmp esi, 0xffffffff
jne 0x4688e5
push 0x4000
push edi
call fcn.00414139
add esp, 4
push eax
call fcn.0041404e
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bd6ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10101f00]
jne 0x100bd6b6
repz ret
jmp fcn.100bd95d

Function at 0x100bdf10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10101ee4], 0
mov byte [0x10101ee8], 0
mov esi, dword [0x10101edc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
add eax, 0x1248
mov dword [0x10101ed8], eax
mov dword [0x10101ee0], 0
jmp 0x100bdf7f
mov eax, dword [0x10101edc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x101c
mov dword [0x10101ed8], eax
mov dword [0x10101ee0], 0
jmp 0x100bdfc2
mov eax, dword [0x10101ee0]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10101ed8], 0xa1e
mov eax, dword [0x10101ee0]
add eax, 1
mov dword [0x10101ee0], eax
cmp eax, 0x100
jl 0x100bdf7f
jmp 0x100bdf5e
mov dword [0x10101ed8], 0x23eb
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x100
mov dword [0x10101eec], 0
mov dword [0x10101ed8], 0x1dfc
mov ecx, dword [0x10101ee4]
mov edx, dword [0x10101ee0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x24], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10101eec], edi
mov edx, dword [0x10101ed8]
mov eax, edi
mov dword [ebp - 0x28], edx
cdq
mov edi, dword [ebp - 0x24]
idiv edi
mov dword [0x10101ee4], edx
mov edx, dword [ebp - 0x28]
add edx, 0x152a
mov dword [0x10101ed8], edx
mov edx, dword [0x10101ee0]
mov cl, byte [esi + edx]
mov byte [0x10101ee8], cl
mov dword [0x10101ed8], 0x118d
mov edx, dword [0x10101ee4]
mov cl, byte [esi + edx]
mov edx, dword [0x10101ee0]
mov byte [esi + edx], cl
mov cl, byte [0x10101ee8]
mov edx, dword [0x10101ee4]
mov byte [esi + edx], cl
mov dword [0x10101ed8], 0x24c0
mov edx, dword [0x10101ee0]
add edx, 1
mov dword [0x10101ee0], edx
cmp edx, 0x100
jl 0x100bdfc2
jmp 0x100bdfb0
Function at 0x100be0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [0x10101edc], 0x1410
mov dword [ebp - 0x30], eax
call fcn.100bf170
xor ecx, ecx
mov dword [0x10101ed8], 0x163b
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x100be141
mov dword [0x10101edc], 0x22ea
mov eax, dword [ebp - 0x40]
add eax, 0x11dde
mov ecx, dword [ebp - 0x40]
add ecx, 0xb499
mov edx, dword [ebp - 0x40]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x44]
mov dword [esp + 8], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
call fcn.100be690
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [eax + 4], 0x14aa00
mov ecx, dword [ebp - 0x4c]
mov dword [eax + 8], ecx
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0xc], 0x2010
mov dword [0x10101ed8], 0x1434
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0xfc
mov edi, edx
add edi, esi
add edi, 0x9c
mov esi, dword [edi]
imul edi, eax, 0xfc
add edx, edi
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x40f
mov ecx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x100be141
lea eax, [0x100c082f]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10101ed8], 0x3bc
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
call fcn.100bf0e0
mov dword [0x10101edc], 0x17c9
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.100bdc70
mov ecx, eax
mov dword [0x10101ef4], eax
mov eax, esp
mov edx, dword [ebp - 0x44]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [0x10101edc], 0x1739
mov ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
lea edx, section..data
imul esi, eax, 0xfc
mov edi, edx
add edi, esi
add edi, 0x9c
mov esi, dword [edi]
imul edi, eax, 0xfc
mov ebx, edx
add ebx, edi
add ebx, 0x4c
mov edi, dword [ebx]
imul ebx, eax, 0xfc
add edx, ebx
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x40]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], edx
call fcn.100be2a0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
add eax, ecx
mov edx, dword [ebp - 0x60]
add edx, 1
cmp edx, 0x40f
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edx
je 0x100be0d7
jmp 0x100be211
Function at 0x100be4a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x10101ed8], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10101ed8], 0x2420
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x100be545
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x64
je 0x100be5b9
jmp 0x100be5fa
mov dword [0x10101ed8], 0x23ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x100be59a
jmp 0x100be5fa
mov eax, dword [ebp - 0x1c]
mov dword [0x10101ed8], 0x568
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x100be585
jmp 0x100be5fa
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
je 0x100be524
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [0x10101edc], 0xffffe35a
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ecx
jl 0x100be545
jmp 0x100be524
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x100be506
jmp 0x100be5fa
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x64
je 0x100be4e0
jmp 0x100be5fa
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100be5fa
mov eax, dword [0x10101edc]
add eax, 0x1815
mov dword [0x10101edc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x100be5fa
mov eax, 1
mov dword [0x10101ed8], 0x263b
mov dword [ebp - 0x2c], eax
jmp 0x100be60b
mov dword [0x10101edc], 0x18b8
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x100be60b
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop ebp
ret

Function at 0x100be620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x10101ed8], 0x2ba
mov dword [0x10101edc], 0xffffe8fe
lea eax, [fcn.100be620]
mov dword [ebp - 4], eax
jmp 0x100be64d
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x100be669
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x100be645
mov dword [0x10101ed8], 0xfffff2fa
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x100be64d
Function at 0x100bed00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x10101ed8]
mov dword [0x10101ee0], 0
mov dword [0x10101ee4], 0
mov dword [0x10101ef0], 0
add edi, 0xffffe517
mov dword [0x10101edc], edi
mov edi, dword [0x10101ed8]
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
je 0x100beeb7
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff5ed
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x100
mov dword [0x10101edc], ecx
mov dword [0x10101ed8], 0x14b6
mov ecx, dword [0x10101ee0]
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
mov ecx, dword [ebp - 0x34]
idiv ecx
mov dword [0x10101ee0], edx
mov esi, dword [0x10101ee4]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10101ee4], edx
mov dword [0x10101ed8], 0x44
mov edx, dword [0x10101ee0]
mov bl, byte [edi + edx]
mov byte [0x10101ee8], bl
mov dword [0x10101ed8], 0xe50
mov edx, dword [0x10101ee4]
mov bl, byte [edi + edx]
mov edx, dword [0x10101ee0]
mov byte [edi + edx], bl
mov bl, byte [0x10101ee8]
mov edx, dword [0x10101ee4]
mov byte [edi + edx], bl
mov edx, dword [0x10101ed8]
add edx, 0xb7f
mov dword [0x10101edc], edx
mov edx, dword [0x10101ee0]
movzx edx, byte [edi + edx]
mov esi, dword [0x10101ee4]
movzx esi, byte [edi + esi]
add esi, edx
mov dword [0x10101edc], 0x10dd
and esi, 0xff
mov dword [0x10101ef0], esi
mov edx, dword [0x10101ed8]
add edx, 0xffffe052
mov dword [0x10101ed8], edx
mov bl, byte [edi + esi]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
movzx ecx, byte [edx + esi]
mov dword [esp], ecx
movzx ecx, bl
mov dword [esp + 4], ecx
call fcn.10001000
mov ecx, 0xc10
mov edx, 0x1fd
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
mov byte [esi + edi], al
mov dword [0x10101ed8], 0xc10
add edi, 1
mov eax, dword [ebp - 0x10]
cmp edi, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ecx
jne 0x100bed7b
mov eax, dword [ebp - 0x24]
add eax, 0xffffdbf0
mov dword [0x10101edc], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xfc82c0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00fc8410
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xfc82e6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfc82d2
add dl, dl
jne 0xfc82f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfc8344
xor eax, eax
add dl, dl
jne 0xfc82fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfc83e5
add dl, dl
jne 0xfc830d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfc8318
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfc8323
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfc832e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xfc833a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xfc82dd
mov eax, 1
add dl, dl
jne 0xfc8352
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfc835d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfc8349
sub eax, ebx
mov ebx, 1
jne 0xfc8390
mov ecx, 1
add dl, dl
jne 0xfc8376
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfc8381
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfc836d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfc82dd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xfc83a7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfc83b2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfc839e
cmp eax, 0x7d00
jae 0xfc83d5
cmp eax, 0x500
jb 0xfc83d0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfc82dd
cmp eax, 0x7f
ja 0xfc83d8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfc82dd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xfc8406
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xfc82dd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403e59
pop dword [ebp - 0x20]
mov eax, 0xc49d7585
sub eax, 0xc45d372c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x417bf8
sub dword [ebp - 0x30], 0xb1ef36ad
mov dword [ebp - 0x2c], 0x2fdf6909
add dword [ebp - 0x2c], 0x253e33c
mov dword [ebp - 0x28], 0x9c9d460a
sub dword [ebp - 0x28], 0x505101dc
mov dword [ebp - 0x24], 0x2907dd0d
add dword [ebp - 0x24], 0xd6f822f3
lea eax, [ebp - 0x30]
push eax
mov eax, 0xb132a859
sub eax, 0xb0f227cd
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x49379237
add dword [ebp - 0x30], 0x2b3ad71f
mov dword [ebp - 0x2c], 0xa0fc7a68
add dword [ebp - 0x2c], 0xa06fe70d
mov dword [ebp - 0x28], 0x4e775870
add dword [ebp - 0x28], 0x14f813fc
mov dword [ebp - 0x24], 0x60f4a6cc
add dword [ebp - 0x24], 0x9f0b5934
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x3f230f36
sub eax, 0x3ee28e62
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x372f5
push 0
call eax
mov ecx, 0x9a787afb
add ecx, 0x6587cec5
mov edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x20]
mov edi, 0xbdd9de08
add dword [ebp - 4], 0xb161d696
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0x7e463680
sub esi, edi
add dword [ebp - 0xc], 0x81636d24
mov dword [edx], esi
sub dword [ebp - 0x18], edi
add edx, 4
add ebx, 0xd10e3d1c
sub ebx, 0xd10e3d18
loop 0x403f6f
add eax, 0x4a2d1831
add eax, 0xb5d401a2
mov ebx, eax
add eax, 0x5f069bdf
sub eax, 0x5f069bda
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x402778
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402786
call dword [0x48d014]
or eax, eax
je 0x402787
ret
mov al, 1
jmp fcn.00402804

Function at 0x402790
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40279e
call dword [0x48d018]
or eax, eax
jne 0x40279f
ret
mov al, 2
jmp fcn.00402804

Function at 0x4027a8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027e0
test edx, edx
je 0x4027ca
push eax
mov eax, ecx
call dword [0x48d01c]
pop ecx
or eax, eax
je 0x4027d9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402804
mov dword [eax], edx
mov eax, ecx
call dword [0x48d018]
or eax, eax
jne 0x4027c3
ret
mov al, 1
jmp fcn.00402804
test edx, edx
je 0x4027f4
push eax
mov eax, edx
call dword [0x48d014]
pop ecx
or eax, eax
je 0x4027d9
mov dword [ecx], eax
ret

Function at 0x402804
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x490004]
test ecx, ecx
je 0x402814
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40282d]
jns 0x402828
call fcn.004069f4
mov eax, dword [eax + 4]
jmp fcn.00403a4c

Function at 0x402cdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d54
xor eax, eax
push ebp
push 0x402d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d54
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402ff4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40300e
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x40300e
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402ffa
mov al, 0xa
jmp fcn.00402804
ret

Function at 0x403040
Capabilities:
Terminate process

Disassembly:
cmp dword [0x490018], 0
je 0x40295f
call dword [0x490018]
mov eax, 0xd2
jmp fcn.00403a4c
push eax
push ecx
mov eax, dword [eax]
call fcn.00403010
pop ecx
pop eax
je 0x40304f
jmp ebx
pop ecx
jmp 0x402950

Function at 0x403058
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403010
mov eax, ebx
pop ebx
jne 0x40306d
pop ecx
jmp 0x402950
ret
Function at 0x403928
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4904a0
mov esi, 0x490034
mov edi, 0x490038
cmp byte [ebx + 0x24], 0
jne 0x403957
cmp dword [edi], 0
je 0x403957
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403946
cmp dword [0x49003c], 0
je 0x40399e
call fcn.004038a4
cmp byte [0x490044], 0
je 0x403984
mov edx, 0x48d024
mov eax, 0x490218
call fcn.00406290
call fcn.00406213
jmp 0x403997
push 0
push 0x48d044
push 0x48d024
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x49003c], eax
cmp byte [ebx + 0x24], 2
jne 0x4039ae
cmp dword [esi], 0
jne 0x4039ae
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403778
cmp byte [ebx + 0x24], 1
jbe 0x4039be
cmp dword [esi], 0
je 0x4039db
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4039db
call fcn.00405c94
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4039db
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403750
cmp byte [ebx + 0x24], 1
jne 0x4039e9
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4039f4
call fcn.004038f4
cmp dword [ebx], 0
jne 0x403a01
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x40399e

Function at 0x4040bc
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404080
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404080
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404068
ret

Function at 0x404164
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402804
test ecx, ecx
je fcn.00404080
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404068
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40422c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40426b
cmp al, 0xb
je 0x40426b
cmp al, 0xc
je 0x404275
cmp al, 0xd
je 0x404288
cmp al, 0xe
je 0x4042a6
cmp al, 0xf
je 0x40426b
cmp al, 0x11
je 0x40426b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402804
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40426b
jmp 0x4042ba
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404275
jmp 0x4042ba
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.0040422c
dec edi
jg 0x40428b
pop ebp
jmp 0x4042ba
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404200
dec edi
jg 0x4042a9
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4042c0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.0040422c