joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cb00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41cc6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404ffc
mov eax, dword [ebp - 4]
call fcn.0041c580
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x41cb52
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004054ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041cffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41cc27
xor eax, eax
push ebp
push 0x41cc20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041c72c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0041cc78
test al, al
je 0x41cbfe
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405054
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x41cbfe
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x41cbf8
mov eax, dword [ebp - 8]
call fcn.00405404
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040516c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0041cb00
dec ebx
cmp ebx, 0xffffffff
jne 0x41cbb1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc27
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041c72c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0041c718
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc71
lea eax, [ebp - 0x3c]
call fcn.00404f64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f88
ret
Function at 0x41cc27
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41cc6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404ffc
mov eax, dword [ebp - 4]
call fcn.0041c580
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x41cb52
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004054ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041cffc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41cc27
xor eax, eax
push ebp
push 0x41cc20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041c72c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0041cc78
test al, al
je 0x41cbfe
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405054
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x41cbfe
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x41cbf8
mov eax, dword [ebp - 8]
call fcn.00405404
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040516c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0041cb00
dec ebx
cmp ebx, 0xffffffff
jne 0x41cbb1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc27
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041c72c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0041c718
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc71
lea eax, [ebp - 0x3c]
call fcn.00404f64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f88
ret

Function at 0x41cc78
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403870
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x44037c]
cmp byte [edx + 0xc], 0
je 0x41ccdc
mov edx, dword [0x44036c]
cmp dword [edx], 2
jne 0x41ccdc
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x41cf10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0041c594
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405404
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x41cf6f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x440158]
mov dl, 1
mov eax, dword [0x41c48c]
call fcn.0040c8a4
call fcn.004048d8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41cf78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405404
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41cfd0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x440388]
mov dl, 1
mov eax, dword [0x41c48c]
call fcn.0040c8a4
call fcn.004048d8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041c5c4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x428dc4
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x43fe4c], 0
mov eax, dword [0x44036c]
cmp dword [eax], 2
jne 0x428f9d
mov eax, dword [0x440048]
cmp dword [eax], 5
jl 0x428f9d
call fcn.00420a1c
test al, al
jne 0x428df5
call fcn.00420a28
call fcn.00420a14
mov dword [0x43fe54], eax
push 0x428fa0
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe18], eax
cmp dword [0x43fe18], 0
jne 0x428e50
mov edx, 0x8000
mov eax, 0x428fb4
call fcn.0040e584
mov dword [0x43fe50], eax
mov eax, dword [0x43fe50]
mov dword [0x43fe54], eax
push 0x428fa0
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe18], eax
cmp dword [0x43fe18], 0
je 0x428f98
push 0x428fc0
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe1c], eax
cmp dword [0x43fe1c], 0
je 0x428f98
push 0x428fcc
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe20], eax
cmp dword [0x43fe20], 0
je 0x428f98
mov byte [0x43fe4c], 1
push 0x428fdc
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe24], eax
push 0x428fe8
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe28], eax
push 0x428ff4
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe2c], eax
push 0x429004
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe30], eax
push 0x429014
mov eax, dword [0x43fe54]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe34], eax
mov edx, 0x8000
mov eax, 0x42902c
call fcn.0040e584
mov dword [0x43fe58], eax
cmp dword [0x43fe58], 0
je 0x428f9d
push 0x42903c
mov eax, dword [0x43fe58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe38], eax
push 0x429058
mov eax, dword [0x43fe58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe3c], eax
push 0x429078
mov eax, dword [0x43fe58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe40], eax
push 0x429094
mov eax, dword [0x43fe58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe44], eax
push 0x4290ac
mov eax, dword [0x43fe58]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43fe48], eax
ret
call fcn.00428d44
ret
Function at 0x438bd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
lea eax, [ebp - 0x20]
call fcn.00411f88
xor eax, eax
push ebp
push 0x438d92
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c4ec]
call fcn.0041c5ec
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x438d55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
or dword [eax + 0x18], 0x100
mov edx, ebx
mov eax, dword [ebp - 0x24]
call fcn.0041c6c8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
call fcn.0041c730
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
call fcn.0041c80c
mov eax, dword [ebp + 8]
cmp eax, 5
ja case.0x438c6f.0
jmp dword [eax*4 + 0x438c76]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x20]
call fcn.004111e4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0041cd58
jmp case.0x438c6f.0
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x20]
call fcn.004111e4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0041cd88
jmp case.0x438c6f.0
lea eax, [ebp - 0x20]
call fcn.0041059c
mov dword [ebp - 0x28], eax
push 4
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0041ce98
jmp case.0x438c6f.0
lea eax, [ebp - 0x20]
call fcn.0041059c
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0041ce30
jmp case.0x438c6f.0
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x20]
call fcn.004111e4
lea eax, [ebp - 0xc]
mov edx, 0x438dac
call fcn.00405240
lea eax, [ebp - 0xc]
call fcn.00405464
mov esi, eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x438d30
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x438d5f
mov eax, dword [ebp - 0x24]
call fcn.0041c698
mov eax, dword [ebp - 0x24]
call fcn.0040407c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438d99
lea eax, [ebp - 0x20]
call fcn.004100ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f88
ret
Function at 0x438fd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
xor eax, eax
push ebp
push 0x439099
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403870
mov eax, dword [ebp - 4]
call fcn.00405404
mov edx, eax
lea eax, [ebp - 0x128]
call fcn.0040516c
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x122]
call fcn.00408fec
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x414
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x439076
mov bl, 1
jmp 0x439078
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4390a0
lea eax, [ebp - 0x128]
call fcn.00404f64
lea eax, [ebp - 4]
call fcn.00404f64
ret

Function at 0x4390a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
xor eax, eax
push ebp
push 0x43913b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408498
cmp dword [ebp - 0xc], 0
je 0x439120
push 0x439154
push dword [ebp - 4]
push 0x439178
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405308
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x10]
mov ecx, 0x439198
mov edx, dword [ebp - 4]
call fcn.0040528c
mov eax, dword [ebp - 0x10]
call fcn.00438fd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439142
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f88
ret
Function at 0x4391a0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4391a8
xor eax, eax
push ebp
push 0x4392a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4392bc
mov edx, 0x4392d4
mov eax, 0x80000001
call fcn.00438db0
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.004111e4
push 1
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x43930c
mov edx, 0x4392d4
mov eax, 0x80000001
call fcn.00438db0
lea edx, [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004111e4
mov edx, 0x4392d4
mov eax, 0x80000001
call fcn.00438b58
mov edx, 0x4392d4
mov eax, 0x80000002
call fcn.00438b58
cmp dword [ebp - 4], 0
je 0x439250
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.00411f24
lea eax, [ebp - 0x38]
push eax
push 1
mov ecx, 0x4392bc
mov edx, 0x4392d4
mov eax, 0x80000001
call fcn.00438bd4
cmp dword [ebp - 8], 0
je 0x43927b
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 8]
call fcn.00411f24
lea eax, [ebp - 0x48]
push eax
push 1
mov ecx, 0x43930c
mov edx, 0x4392d4
mov eax, 0x80000001
call fcn.00438bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4392b0
lea eax, [ebp - 0x48]
mov edx, dword [0x401090]
mov ecx, 4
call fcn.00405ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f88
ret
Function at 0x439a54
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00439b40
test al, al
je 0x439b01
xor eax, eax
push ebp
push 0x439afa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00439b94
test al, al
jne 0x439a95
call fcn.00404984
jmp 0x439b01
xor eax, eax
push ebp
push 0x439add
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x439ac3
mov edx, 0x439b14
mov eax, dword [ebp - 4]
call fcn.00439b24
jmp 0x439ac7
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439ae4
mov eax, dword [ebp - 4]
call fcn.004399cc
ret
movzx eax, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43a2b8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43a3be
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x10], 1
je 0x43a310
cmp byte [ebx + 0x10], 2
jne 0x43a39b
lea eax, [ebp - 0xc]
mov ecx, 0x43a3d4
mov edx, dword [ebx + 0x14]
call fcn.0040528c
mov eax, dword [ebp - 0xc]
call fcn.00408c2c
test al, al
je 0x43a39b
call fcn.0040a940
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 8]
mov edx, 0x43a3e4
call fcn.0040b540
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x43a404
call fcn.004098dc
movzx eax, byte [0x43a41c]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x43a428
mov edx, 0x43a434
mov eax, dword [ebp - 4]
call fcn.0040da20
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a3c5
lea eax, [ebp - 0x30]
call fcn.00404f64
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f88
ret

Function at 0x43a438
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43a515
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040a940
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 8]
mov edx, 0x43a52c
call fcn.0040b540
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebx + 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x43a54c
call fcn.004098dc
movzx eax, byte [0x43a564]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x43a570
mov edx, 0x43a57c
mov eax, dword [ebp - 4]
call fcn.0040da20
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.kernel32.dll_OutputDebugStringA
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00439d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a51c
lea eax, [ebp - 0x2c]
call fcn.00404f64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f88
ret
Function at 0x43c8c0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x43cab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x43cacc
call fcn.0043a590
mov eax, dword [0x440344]
mov byte [eax], 0
mov eax, dword [0x43ffa8]
mov byte [eax], 0
xor eax, eax
push ebp
push 0x43ca58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x43cae0
call sub.kernel32.dll_OutputDebugStringA
mov eax, 0x43caf0
call fcn.0040dd4c
test al, al
je 0x43c95e
push 0x43caf8
call sub.kernel32.dll_OutputDebugStringA
push 1
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403314
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408de4
lea eax, [ebp - 4]
mov edx, 0x43cb08
call fcn.00405240
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.kernel32.dll_WinExec
jmp 0x43ca4e
call fcn.00439894
test al, al
je 0x43c9b3
push 0x43cb20
call sub.kernel32.dll_OutputDebugStringA
push 1
push 0
push 0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040df10
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408de4
lea eax, [ebp - 0xc]
mov edx, 0x43cb30
call fcn.00405240
mov eax, dword [ebp - 0xc]
call fcn.00405404
push eax
push 0x43cb3c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x43ca4e
push 0x43cb44
call sub.kernel32.dll_OutputDebugStringA
call fcn.004393c0
test al, al
je 0x43c9d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ca98
push 0x43cb4c
call sub.kernel32.dll_OutputDebugStringA
call fcn.0043948c
push 0x43cb54
call sub.kernel32.dll_OutputDebugStringA
push 1
push 0
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.0040df10
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408de4
lea eax, [ebp - 0x14]
mov edx, 0x43cb30
call fcn.00405240
mov eax, dword [ebp - 0x14]
call fcn.00405404
push eax
push 0x43cb3c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x43cb5c
call sub.kernel32.dll_OutputDebugStringA
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x440344]
cmp byte [eax], 0
je 0x43ca33
mov eax, dword [0x43ffa8]
cmp byte [eax], 0
je 0x43ca33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ca8e
mov eax, 0x43cb88
call fcn.0043a590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43caba
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404f88
ret
Function at 0x43e488
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x43d264
call fcn.00406ef8
mov esi, 0x445a50
xor eax, eax
push ebp
push 0x43e697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x43e6b0
call fcn.0043a590
push 0
mov ecx, 0x43e6c8
mov dl, 1
mov eax, dword [0x439944]
call fcn.004399d8
mov dword [0x445a4c], eax
xor eax, eax
push ebp
push 0x43e52f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x33
mov edx, esi
mov eax, dword [0x445a4c]
call fcn.00439a54
test al, al
je 0x43e514
cmp dword [esi + 4], 1
je 0x43e517
push 0x43e6d8
call sub.kernel32.dll_OutputDebugStringA
push 0x64
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x43e4ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e536
mov eax, 0x445a4c
call fcn.0040e4b8
ret
Function at 0x4014c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4014ca
repz ret
jmp fcn.004017b6