joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100280de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100392d0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10039498]
je 0x1002810b
inc eax
cmp eax, 0x12
jb 0x100280fc
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10039498]
jne 0x1002823f
mov eax, dword [0x1003a230]
cmp eax, 1
je 0x1002821a
cmp eax, edx
jne 0x1002813b
cmp dword [0x1003a234], 1
je 0x1002821a
cmp ecx, 0xfc
je 0x1002823f
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10028174
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.1002a780
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.10028620
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100281b6
lea eax, [ebp - 0x10c]
push eax
call fcn.10028620
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x10031588
push edi
call fcn.1002b310
add esp, 0x10
push edi
call fcn.10028620
push dword [esi + 0x1003949c]
mov ebx, eax
call fcn.10028620
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10025770
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1002a780
push edi
push ebx
call fcn.1002a790
push 0x10031568
push ebx
call fcn.1002a790
push dword [esi + 0x1003949c]
push ebx
call fcn.1002a790
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.1002bf0d
add esp, 0x2c
jmp 0x1002823f
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x1003949c]
push dword [esi]
call fcn.10028620
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.1002730e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10028843
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.10025770
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100288d8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1003a3a0]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x100288d8
cmp eax, 1
je 0x100288f0
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100288d8
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x100288ad
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x100288d4
xor eax, eax
inc eax
jmp 0x1002890c
cmp esi, ebx
jae 0x100288dc
xor eax, eax
jmp 0x1002890c
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1003a3a0]
jmp 0x100288f2
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002bf0d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1003a584], ebx
push esi
push edi
jne 0x1002bf8d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1002bfc8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1003a584], eax
je 0x1002bfc8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1003a588], eax
call esi
cmp dword [0x1003a3a0], 2
mov dword [0x1003a58c], eax
jne 0x1002bf8d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1003a594], eax
je 0x1002bf8d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1003a590], eax
mov eax, dword [0x1003a590]
test eax, eax
je 0x1002bfd2
call eax
test eax, eax
je 0x1002bfb9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1003a594]
test eax, eax
je 0x1002bfb9
test byte [ebp - 8], 1
jne 0x1002bfd2
cmp dword [0x1003a3ac], 4
jb 0x1002bfcc
or byte [ebp + 0x12], 0x20
jmp 0x1002bff1
xor eax, eax
jmp 0x1002c001
or byte [ebp + 0x12], 4
jmp 0x1002bff1
mov eax, dword [0x1003a588]
test eax, eax
je 0x1002bff1
call eax
mov ebx, eax
test ebx, ebx
je 0x1002bff1
mov eax, dword [0x1003a58c]
test eax, eax
je 0x1002bff1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1003a584]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002c45a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x1002c4c5
push 0x3d
push dword [ebp + 8]
call fcn.1002e767
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x1002c4c5
cmp dword [ebp + 8], esi
je 0x1002c4c5
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x1003a3c0]
cmp eax, dword [0x1003a3c4]
jne 0x1002c4ab
mov edi, eax
call fcn.1002c3f9
mov dword [0x1003a3c0], eax
cmp eax, ebx
jne 0x1002c504
cmp dword [ebp + 0xc], ebx
je 0x1002c4cd
cmp dword [0x1003a3c8], ebx
je 0x1002c4cd
call fcn.100286ab
test eax, eax
je 0x1002c504
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x1002c608
push 4
call fcn.10024c1b
cmp eax, ebx
pop ecx
mov dword [0x1003a3c0], eax
je 0x1002c4c5
mov dword [eax], ebx
cmp dword [0x1003a3c8], ebx
jne 0x1002c504
push 4
call fcn.10024c1b
cmp eax, ebx
pop ecx
mov dword [0x1003a3c8], eax
je 0x1002c4c5
mov dword [eax], ebx
mov ebx, dword [0x1003a3c0]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.1002c3ac
mov edi, eax
test edi, edi
pop ecx
jl 0x1002c55d
cmp dword [ebx], 0
je 0x1002c55d
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.10024b03
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x1002c545
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x1002c593
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x1002c53c
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.100250fa
test eax, eax
pop ecx
pop ecx
je 0x1002c593
jmp 0x1002c58e
cmp dword [ebp - 4], 0
jne 0x1002c601
test edi, edi
jge 0x1002c56d
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.100250fa
test eax, eax
pop ecx
pop ecx
je 0x1002c4c5
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x1003a3c0], eax
cmp dword [ebp + 0xc], 0
je 0x1002c5ea
push dword [ebp + 8]
call fcn.10028620
inc eax
inc eax
push eax
call fcn.10024c1b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1002c5ea
push dword [ebp + 8]
push esi
call fcn.1002a780
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1002c5e3
or dword [ebp - 8], 0xffffffff
push esi
call fcn.10024b03
pop ecx
cmp dword [ebp - 4], 0
je 0x1002c5f9
push dword [ebp + 8]
call fcn.10024b03
pop ecx
mov eax, dword [ebp - 8]
jmp 0x1002c4c8
push esi
call fcn.10024b03
pop ecx
xor eax, eax
jmp 0x1002c4c8
Function at 0x401456
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x104
push 0x42a408
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.004020b1
call fcn.00401df8
mov dword [0x42a50c], eax
call fcn.0040262c
call fcn.004013c2
call section..text
test eax, eax
jne 0x4014ec
call fcn.004010f6
cmp dword [0x42a55c], esi
je 0x4014d2
jmp loc.0042c000
call fcn.004011f0
cmp dword [0x42a55c], esi
je 0x4014ec
cmp dword [0x42a564], esi
jne 0x4014ec
call fcn.004023c0
cmp dword [0x42a560], esi
je 0x4014fc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40198f
pop dword [ebp - 0x48]
mov eax, 0x492fb2e0
add eax, 0xb71066af
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x70c9e470
sub dword [ebp - 0x58], 0x22779f25
mov dword [ebp - 0x54], 0x331e95bb
sub dword [ebp - 0x54], 0xeb4976
mov dword [ebp - 0x50], 0x9c5ce2c5
sub dword [ebp - 0x50], 0x50109e97
mov dword [ebp - 0x4c], 0x1cfcfedd
sub dword [ebp - 0x4c], 0x1cfcfedd
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8ef5e1c2
sub eax, 0x8eb4b122
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa1ec5af1
sub dword [ebp - 0x58], 0x2d79f19b
mov dword [ebp - 0x54], 0xf1332d9d
sub dword [ebp - 0x54], 0xafc6cc28
mov dword [ebp - 0x50], 0xddbc5a1b
sub dword [ebp - 0x50], 0x7a4cedaf
mov dword [ebp - 0x4c], 0x6b8e29c3
add dword [ebp - 0x4c], 0x9471d63d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xbe85d88c
add eax, 0x41bb57b0
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc97
push 0
call eax
mov ecx, 0x9caac190
sub ecx, 0x9caa750b
xor ebx, ebx
add ebx, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x48]
mov edi, 0x5e0335c9
sub edi, 0x9dc50302
mov dword [ebp - 0x30], 0x7e05c271
mov esi, dword [edx]
add dword [ebp - 0x38], edi
xor esi, edi
xor dword [ebp - 0x44], 0xdc447ebe
mov dword [ebx], esi
add ebx, 0xadcbb3
add ebx, 0xff523451
add edx, 0x5c78c84c
add edx, 0xa38737b8
loop 0x401aad
add eax, 0x9d823f62
sub eax, 0x9d811a7b
mov ebx, eax
add eax, 0x61752bd0
sub eax, 0x61752bcb
mov ecx, 0x76548bc4
add ecx, 0x89eb743c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x406243
pop dword [ebp - 0x40]
mov eax, 0x13947d01
add eax, 0xecabe542
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa17b2094
add dword [ebp - 0x50], 0xacd724b7
mov dword [ebp - 0x4c], 0xadb3a32a
add dword [ebp - 0x4c], 0x847fa91b
mov dword [ebp - 0x48], 0x9eb94d5f
sub dword [ebp - 0x48], 0x526d0931
mov dword [ebp - 0x44], 0x9a5da0c
add dword [ebp - 0x44], 0xf65a25f4
lea eax, [ebp - 0x50]
push eax
mov eax, 0x1d25dfa2
sub eax, 0x1ce55e9e
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x40f1c234
sub dword [ebp - 0x50], 0xcc7f58de
mov dword [ebp - 0x4c], 0x9b0e26db
add dword [ebp - 0x4c], 0xa65e3a9a
mov dword [ebp - 0x48], 0xa5321d77
add dword [ebp - 0x48], 0xbe3d4ef5
mov dword [ebp - 0x44], 0xd28c85b6
sub dword [ebp - 0x44], 0xd28c85b6
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35deb
push 0
call eax
mov ecx, 0x842fe776
sub ecx, 0x842fa413
mov edi, eax
mov edx, 0x848062e8
sub edx, 0x84397ee8
add edx, dword [ebp - 0x40]
mov esi, 0xf10e852e
sub esi, 0xd4fe5821
sub dword [ebp - 0x30], edi
mov ebx, dword [edx]
sub dword [ebp - 0x30], esi
sub ebx, esi
xor dword [ebp - 0x24], eax
mov dword [edi], ebx
add edi, 4
add edx, 0x6c8b1150
add edx, 0x9374eeb4
loop 0x406360
add eax, 0x1005f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe25d218
sub ecx, 0xde5d218
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x4206cb
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineW]
movzx ecx, word [eax]
push 0x20
pop ebx
push 2
pop edx
push 0x22
pop esi
cmp cx, si
jne 0x4206f5
add eax, edx
movzx ecx, word [eax]
cmp cx, si
je 0x420708
test cx, cx
jne 0x4206e4
jmp 0x420712
cmp cx, bx
jbe 0x42070a
add eax, edx
cmp word [eax], bx
ja 0x4206fa
jmp 0x42070a
cmp cx, bx
ja 0x420712
add eax, edx
movzx ecx, word [eax]
test cx, cx
jne 0x420703
xor esi, esi
push eax
mov dword [0x4aaf10], esi
call main
mov edx, eax
and eax, 0x60
jne 0x420775
test dl, 8
je 0x420731
push 8
pop eax
jmp 0x420775
test edx, 0x1eee
jne 0x42073d
xor eax, eax
jmp 0x420775
push edi
xor edi, edi
inc edi
mov ecx, esi
shl edi, cl
test edi, 0x1eee
je 0x42075c
test edx, edi
je 0x42075c
mov eax, edx
sub eax, edi
test eax, 0x1eee
jne 0x42076e
inc esi
cmp esi, ebx
jb 0x42073e
test dl, 4
je 0x420772
test edx, 0x100
jne 0x420772
xor eax, eax
jmp 0x420774
mov eax, edx
pop edi
pop esi
pop ebx
ret

Function at 0x424331
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4aaf10]
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
mov dword [0x4b4fec], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x4b4fe8], eax
test eax, eax
jne 0x424355
xor eax, eax
ret
mov edx, 0x9c9c
cmp dword [eax], edx
jne 0x424352
mov ecx, dword [eax + 4]
push esi
push edi
mov edi, 0x20001
lea esi, [edi - 1]
cmp ecx, esi
je 0x424377
cmp ecx, edi
jne 0x4243d2
cmp ecx, esi
jne 0x42437b
cmp dword [eax], edx
jne 0x4243d2
cmp ecx, edi
jne 0x424383
cmp dword [eax], edx
jne 0x4243d2
cmp ecx, esi
jne 0x42438b
cmp dword [eax], edx
jne 0x4243d2
push edx
push eax
push 0x4b4ff4
call main
add esp, 0xc
cmp dword [0x4b5018], 0
mov dword [0x4b4ff8], esi
je 0x4243d2
cmp dword [0x4b500c], 0
je 0x4243d2
cmp dword [0x4b5014], 0
je 0x4243d2
cmp dword [0x4aaf04], 0
jne 0x4243cd
cmp dword [0x4b501c], 0
je 0x4243d2
xor eax, eax
inc eax
jmp 0x4243d4
xor eax, eax
pop edi
pop esi
ret

Function at 0x42b1aa
Capabilities:
Connect to http server

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
call fcn.0043714c
mov ebx, 0x4b2374
test eax, eax
je 0x42b1cc
push ebx
push 0x404330
call main
pop ecx
pop ecx
mov eax, dword [0x4b2d7c]
test eax, eax
je 0x42b1da
mov esi, 0x800000
push 1
neg eax
push esi
sbb eax, eax
push 3
and eax, 0x16b
mov ecx, 0x402759
push ecx
add eax, 0x50
movzx eax, ax
push ecx
push eax
push ebx
push dword [0x4b2340]
call dword [sym.imp.WININET.dll_InternetConnectA]
xor esi, esi
inc esi
mov dword [0x4b2344], eax
mov dword [0x4b4fd8], esi
mov dword [0x4b234c], edi
test eax, eax
jne 0x42b23f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x42b258
call fcn.0043714c
test eax, eax
je 0x42b23b
push 0x404348
call main
xor eax, eax
jmp 0x42b25a
push edi
push edi
push 0x1427
push dword [0x4bf7b8]
mov dword [0x4b4fd8], edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42b3f7
Capabilities:
Send data

Disassembly:
mov ecx, dword [0x4b2d8c]
test ecx, ecx
jne 0x42b41a
xor eax, eax
push eax
push eax
push 0x1427
push dword [0x4bf7b8]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret
mov eax, dword [0x4b2d80]
push esi
push edi
push 0x4b2d88
push dword [0x4b2d84]
add eax, ecx
push eax
push dword [0x4b2348]
xor edi, edi
inc edi
mov dword [0x4b4fd8], edi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x42b472
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x42b49b
call fcn.0043714c
test eax, eax
je 0x42b46e
push esi
push 0x4043b0
call main
pop ecx
pop ecx
xor eax, eax
jmp 0x42b49d
xor eax, eax
cmp dword [0x4b2314], 3
mov dword [0x4b4fd8], eax
jne 0x42b488
mov dword [0x4b2304], edi
push eax
push eax
push 0x1427
push dword [0x4bf7b8]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, edi
pop edi
pop esi
ret

Function at 0x436088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x436097
pop dword [ebp - 8]
mov eax, 0x690d8c2b
add eax, 0x9735d46c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2593fd41
sub dword [ebp - 0x18], 0xd741b7f6
mov dword [ebp - 0x14], 0xac6a5600
sub dword [ebp - 0x14], 0x7a3709bb
mov dword [ebp - 0x10], 0x1c6cfdd2
sub dword [ebp - 0x10], 0xd020b9a4
mov dword [ebp - 0xc], 0xf3be7750
add dword [ebp - 0xc], 0xc4188b0
lea eax, [ebp - 0x18]
push eax
mov eax, 0x4b0ee676
sub eax, 0x4aced4c6
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x765dd836
add dword [ebp - 0x18], 0xfe149120
mov dword [ebp - 0x14], 0x7a913962
sub dword [ebp - 0x14], 0x3924d7ed
mov dword [ebp - 0x10], 0xcfc49007
add dword [ebp - 0x10], 0x93aadc65
mov dword [ebp - 0xc], 0x902e958
add dword [ebp - 0xc], 0xf6fd16a8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xf7439f6b
sub eax, 0xf7038db7
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x4ee02
push 0
call eax
mov ecx, 0x45b8
mov edi, eax
mov ebx, 0xabefdab1
add ebx, 0x545d0d4f
add ebx, dword [ebp - 8]
mov esi, 0x8c392c20
add esi, 0x6624e4be
sub dword [ebp - 4], ecx
mov edx, dword [ebx]
xor dword [ebp - 4], ecx
sub edx, esi
xor dword [ebp - 4], 0x2ab9c4cb
mov dword [edi], edx
sub dword [ebp - 4], 0xe70f5c1
add edi, 0xd62a676
sub edi, 0xd62a672
add ebx, 4
loop 0x4361b3
add eax, 0x109b3
xor ebx, ebx
add ebx, eax
add eax, 0xb9fd8ba7
add eax, 0x4602745e
mov ecx, 0xb2c4db06
add ecx, 0x4d7b24fa
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x437f54
Capabilities:
Create process memory minidump

Disassembly:
push 0x448
push 0x4749a0
call fcn.0045d2cc
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp dword [0x4b4ffc], eax
je 0x438181
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x437f8f
cmp dword [ebp + 0x18], eax
je 0x438181
cmp dword [ebp + 0x1c], eax
je 0x438181
push 0x410
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0045d10c
add esp, 0xc
mov di, word [0x4b5798]
test di, di
je 0x43801d
mov edx, 0x404cd4
mov eax, 0x4b5798
mov ecx, eax
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x437fe4
test bx, bx
je 0x437fde
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x437fe4
add ecx, 4
add edx, 4
test bx, bx
jne 0x437fbc
xor ebx, ebx
mov ecx, ebx
jmp 0x437feb
sbb ecx, ecx
sbb ecx, 0xffffffff
xor ebx, ebx
test ecx, ecx
jne 0x437ff4
xor ebx, ebx
inc ebx
jmp 0x43801d
movzx ecx, di
lea edx, [ebp - 0x458]
mov dword [edx], eax
test cx, cx
je 0x43800c
add eax, 2
cmp word [eax], bx
jne 0x438004
add edx, 4
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x437ffd
mov ebx, dword [ebp - 0x1c]
test esi, esi
je 0x438035
push 0x104
push 0x4bef2a
push 0x404cdc
call main
call fcn.0043cae8
test eax, eax
je 0x438181
push 0
push 0x40000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push 0x4b20a8
lea eax, [ebp + 0x20]
push eax
call main
test eax, eax
je 0x438181
lea eax, [ebp - 0x458]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x4bea54
mov eax, dword [0x4b5000]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], esi
mov ecx, dword [0x4b5008]
test ecx, ecx
je 0x4380a9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x43cdce
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1c], eax
cmp dword [0x4bea54], 0
je 0x4380cf
mov eax, dword [0x4bea58]
test esi, esi
je 0x4380d8
or eax, 0x400
jmp 0x4380d4
mov eax, 0x121
test esi, esi
jne 0x4380dd
or eax, 0x200
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x20]
push edx
push ebx
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x2c]
and ecx, edx
push ecx
push eax
push dword [ebp + 0x20]
push dword [0x4b4ffc]
push dword [0x4b501c]
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x438112
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x43817a
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0x20]
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x438137
push 0x41
push 0x4beee8
push 0x4bef2a
call main
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call main
test eax, eax
je 0x438181
cmp dword [edi + 0xc], ebx
je 0x438181
test esi, esi
je 0x438165
cmp dword [0x4bf144], 0
jne 0x438165
mov ecx, dword [0x4b5004]
mov dword [0x4bf144], ecx
xor eax, eax
inc eax
jmp 0x438183
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.0045d311
ret 0x1c
Function at 0x45cd7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a95d0]
jne 0x45d56f
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4c1f10], eax
mov dword [0x4c1f0c], ecx
mov dword [0x4c1f08], edx
mov dword [0x4c1f04], ebx
mov dword [0x4c1f00], esi
mov dword [0x4c1efc], edi
mov word [0x4c1f28], ss
mov word [0x4c1f1c], cs
mov word [0x4c1ef8], ds
mov word [0x4c1ef4], es
mov word [0x4c1ef0], fs
mov word [0x4c1eec], gs
pushfd
pop dword [0x4c1f20]
mov eax, dword [ebp]
mov dword [0x4c1f14], eax
mov eax, dword [ebp + 4]
mov dword [0x4c1f18], eax
lea eax, [ebp + 8]
mov dword [0x4c1f24], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4c1e60], 0x10001
mov eax, dword [0x4c1f18]
mov dword [0x4c1e14], eax
mov dword [0x4c1e08], 0xc0000409
mov dword [0x4c1e0c], 1
mov eax, dword [0x4a95d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4a95d4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4c1e58], eax
push 1
call fcn.00461e8e
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x41c780
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4c1e58], 0
jne 0x45d65b
push 1
call fcn.00461e8e
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x472cbd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4746e1
call fcn.0045feda
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x472ce6
cmp dword [0x4c2cfc], edi
je 0x472dd0
push 2
pop ebx
jmp 0x472d00
cmp edi, 1
jne 0x472dd0
mov eax, ebx
call fcn.00473b25
test al, al
je 0x472dd0
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.00473b47
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x472db2
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x472d47
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
call fcn.004733a7
test eax, eax
je 0x472de4
push 0x1c049f
push 0
call main
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x4aa988], 0
push ebx
mov ecx, 0x4c2d08
call main
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.00473435
mov esi, eax
test esi, esi
je 0x472d33
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00473b68
inc edi
cmp edi, 2
jl 0x472cce
mov eax, esi
call fcn.0045ffb2
ret 0x18
push ebx
mov ecx, 0x4c2d08
call main
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x472dc4
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x472e1f
cmp dword [ebp - 0x20], 3
jne 0x472e1a
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x472e1a
and cl, 0xf
cmp cl, 4
je 0x472e1f
push 2
pop esi
jmp 0x472dc4
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.00473b68
xor eax, eax
jmp 0x472ddc