joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x439a00
xor eax, eax
push eax
push eax
push eax
push eax
jmp loc.00516320

Function at 0x405752
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40576f
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405772
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
jmp loc.00517518

Function at 0x4057a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
jmp loc.00517130

Function at 0x4057e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40585a
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x2000
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405849
cmp dword [ebp + 0x14], 1
je 0x40584b
cmp dword [ebp + 0x14], 2
je 0x40584b
mov byte [esi], bl
jmp 0x516a28
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x405aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405ac4
xor eax, eax
test eax, eax
je 0x405ad6
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ad6
xor ecx, ecx
jmp 0x405ad9
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x407298]
push ecx
lea eax, [ebp + eax - 0x120]
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 8
push 0
jmp 0x5164b0
Function at 0x405be7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x439a48
push esi
call fcn.004059bd
push esi
call fcn.004056db
mov edi, eax
test edi, edi
jne 0x405c08
xor eax, eax
jmp 0x405c60
push edi
call fcn.004059df
test byte [0x446c68], 0x80
je 0x405c21
mov al, byte [edi]
test al, al
je 0x405c04
cmp al, 0x5c
je 0x405c04
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405c41
push esi
call fcn.00405a79
test eax, eax
je 0x405c3b
test byte [eax], 0x10
je 0x405c65
push esi
call fcn.00405bc0
push esi
call ebx
cmp eax, edi
jg 0x405c2c
push esi
call fcn.00405b93
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405c5f
Function at 0x405f1d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
call fcn.00405b0e
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405f41
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40607a
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ba48], 0x4c554e
mov edi, 0x400
mov ebp, 0x43ba48
test esi, esi
je 0x405f85
push 1
push 0
push esi
call fcn.00405772
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406080
cmp eax, edi
jg 0x406080
push edi
mov esi, 0x43c388
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
jmp 0x517450
inc dword [0x446cd0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4060b6
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405be7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4060eb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x446cc8], eax
jmp 0x40627d
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x406106
test eax, eax
jmp 0x517f40
push edi
push ebx
mov esi, 0x43c788
push esi
call fcn.004059bd
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x406129
push str..
push esi
call edi
jmp 0x40612f
push ebx
call fcn.00405bc0
cmp byte [ebx], 0
jne 0x40613d
cmp byte [0x43c788], 0x5c
jne 0x406145
push 0x407298
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40621d
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405697
cmp byte [eax], 0
je 0x406188
cmp byte [ebp - 0x18], 0
je 0x406188
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40619e
mov al, byte [esi + 1]
test al, al
je 0x4061fc
cmp al, 0x2e
jne 0x40619e
cmp byte [esi + 2], 0
je 0x4061fc
push esi
push edi
call fcn.004059bd
test byte [ebp - 0x148], 0x10
je 0x4061c3
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4061fc
push dword [ebp + 0xc]
push ebx
call fcn.004060b6
jmp 0x4061fc
push ebx
call fcn.00405752
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4061f4
test byte [ebp + 0xc], 4
je 0x4061ec
push ebx
push 0xfffffffffffffff1
call fcn.0040490d
push 0
push ebx
call fcn.00405f1d
jmp 0x4061fc
inc dword [0x446cc8]
jmp 0x4061fc
push ebx
push 0xfffffffffffffff2
call fcn.0040490d
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40616a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406227
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40627c
cmp dword [ebp - 8], esi
je 0x40626c
push ebx
call fcn.00405a79
test eax, eax
je 0x40627c
push ebx
call fcn.00405b93
push ebx
call fcn.00405752
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406274
test byte [ebp + 0xc], 4
je 0x40626c
push ebx
push 0xfffffffffffffff1
call fcn.0040490d
push esi
push ebx
call fcn.00405f1d
jmp 0x40627c
inc dword [0x446cc8]
jmp 0x40627c
push ebx
push 0xffffffffffffffe5
call fcn.0040490d
pop esi
pop ebx
leave
ret 8
Function at 0x406282
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43e78c], 0
jne 0x4062c0
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406296
mov dword [ecx*4 + 0x43e788], eax
inc ecx
cmp ecx, 0x100
jl 0x406291
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4062ed
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
jmp 0x516258
not eax
pop ebp
ret 0xc
Function at 0x4058f0
Capabilities:
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x401236
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4011a0
mov edx, dword [ebp + 0xc]
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], eax
call sub.MSVBVM60.DLL___vbaStrCopy
push dword [ebp - 0x28]
call sub.MSVBVM60.DLL___vbaLenBstr
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push dword [esi]
push 1
pop edi
push edi
call sub.MSVBVM60.DLL___vbaLbound
push dword [esi]
mov dword [ebp - 0x20], eax
push edi
call sub.MSVBVM60.DLL___vbaUbound
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jg 0x405a1a
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], edi
push ecx
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x40], 2
call sub.MSVBVM60.DLL_rtcMidCharBstr
mov edx, eax
lea ecx, [ebp - 0x30]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
call sub.MSVBVM60.DLL_rtcAnsiValueBstr
mov cx, ax
xor ecx, 0xee
call sub.MSVBVM60.DLL___vbaUI1I2
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x2c], al
call sub.MSVBVM60.DLL___vbaFreeStr
lea ecx, [ebp - 0x40]
call sub.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
sar eax, 0x1f
mov ecx, eax
xor eax, ebx
xor ecx, dword [ebp - 0x14]
cmp eax, ecx
jg 0x405a00
push ebx
push dword [esi]
call sub.MSVBVM60.DLL___vbaDerefAry1
movzx ecx, byte [eax]
movzx eax, byte [ebp - 0x2c]
xor ecx, eax
mov eax, ebx
and eax, 0xee
xor ecx, eax
call sub.MSVBVM60.DLL___vbaUI1I4
push ebx
mov dl, al
push dword [esi]
mov byte [ebp - 0x65], dl
call sub.MSVBVM60.DLL___vbaDerefAry1
mov cl, byte [ebp - 0x65]
mov byte [eax], cl
mov eax, dword [ebp - 0x24]
add eax, ebx
jo 0x405a4c
jmp 0x4059af
mov eax, dword [ebp - 0x20]
push 1
add eax, edi
jo 0x405a4c
mov dword [ebp - 0x20], eax
pop eax
add eax, dword [ebp - 0x1c]
jo 0x405a4c
mov dword [ebp - 0x1c], eax
jmp 0x405958
push 0x405a3b
jmp 0x405a32
lea ecx, [ebp - 0x28]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a5f
mov esp, ebp
pop ebp
ret

Function at 0x433080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x433098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x433176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004339e0
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x433171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004339e0
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43314a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43314a
xor eax, eax
jmp 0x433176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43308f
mov esp, ebp
pop ebp
ret

Function at 0x4339e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x433a15
xor eax, eax
jmp 0x433a1f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret
Function at 0x408c70
Capabilities:
Set socket configuration

Disassembly:
cld
push eax
and bh, byte [esi + 0x66]
cmp dword [eax - 0x3ba383c], eax
mov al, byte [eax]
jmp 0x408c38
invalid
push ebp
mov ebp, esp
call 0x564cea03
mov ebx, dword [ecx]
or byte [edi - 0x75], dl
jge 0x408c29
mov eax, ebx
or esp, ecx
jne 0x408cae
mov ecx, edi
ljmp 0x7d20
test edi, edi
jl 0x37408d51
jg 0x408cc0
test ebx, ebx
jbe 0x408d47
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
or eax, ecx
dec esi
adc al, 0x8b
dec esi
add al, 0x51
call fcn.00408bd0
add eax, 0xc08504c4
lahf
test edi, eax
add al, 0
add byte [ebx - 0x2cc40e22], cl
jne 0x408cf0
mov eax, dword [esi + 0x24]
cmp eax, dword [ebx + 0xf]
test ah, bh
add byte [eax + eax], al
mov edx, dword [ecx + 0x10]
int1
add byte [eax - 0x18], ch
sbb byte [eax], al
out dx, al
push ecx
push ebx
lea edi, [esi + 0x18]
call fcn.0040b5f2
mov edx, dword [esi + 4]
mov ebx, dword [sym.imp.WSOCK32.dll_closesocket]
push 4
push edi
push 0x1006
push 0x81ffff
jp 0x408ccb
adc bh, bh
ror dword [ebx + 0x506a0446], cl
push edi
push 0xd70010b5
push 0xffca
push eax
call ebx
pop ecx
jge 0x408d45
mov eax, esi
ljmp 0x205e
or al, 0
test edi, edi
jg 0x408d9d
jl 0x408d51
ja 0x408d2a
jae 0x408cf9
mov ecx, dword [esi + 4]
invalid
mov dword [esi - 0x60], ebx
or dword [esi + 0x6a], edi
xor eax, eax
loope 0x408e05
xor bl, byte [ebp - 0x3e]
pop ds
add byte [eax + 0x2a9090c6], dl
sub dl, dl
in al, dx
push ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
aas
dec ebp
and cl, byte [ebx - 0x67cf3b4]
inc eax
push esi
jg 0x409041
lgs eax, [edi]
add al, byte [eax]
add byte [ecx - 0x50], cl
stc
invalid
lea eax, [ecx]
cld
push 0xffffffffffffffd2
push eax
or dl, byte [eax + ebp*2 - 0x4fff0001]
push ecx
call dword [0xac1b8]
cmp eax, 0xffffffff
andnps xmm0, xmm1
add al, byte [eax]
add byte [ebx - 0x3f7a64bb], cl
mov esp, edi
cmp byte [esi + ecx + 0xc], dh
add cl, byte [ecx + 0x502e3846]
pop esi
mov esp, ebp
pop ebp
ret 0xc
bswap esi
ret 0xd03b
Function at 0x402798
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027a6
call dword [0x49401c]
or eax, eax
je 0x4027a7
ret
mov al, 1
jmp fcn.00402824

Function at 0x4027b0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027be
call dword [0x494020]
or eax, eax
jne 0x4027bf
ret
mov al, 2
jmp fcn.00402824

Function at 0x4027c8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402800
test edx, edx
je 0x4027ea
push eax
mov eax, ecx
call dword [0x494024]
pop ecx
or eax, eax
je 0x4027f9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402824
mov dword [eax], edx
mov eax, ecx
call dword [0x494020]
or eax, eax
jne 0x4027e3
ret
mov al, 1
jmp fcn.00402824
test edx, edx
je 0x402814
push eax
mov eax, edx
call dword [0x49401c]
pop ecx
or eax, eax
je 0x4027f9
mov dword [ecx], eax
ret

Function at 0x402824
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x497004]
test ecx, ecx
je 0x402834
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40284d]
jns 0x402848
call fcn.00406d1c
mov eax, dword [eax + 4]
jmp fcn.00403b40

Function at 0x4029ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029db
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c30
jmp 0x4029f9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402934
mov edi, eax
test ebx, ebx
je 0x4029f9
cmp dword [esi], 0
je 0x4029f9
dec ebx
jmp 0x4029e2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e44
xor eax, eax
push ebp
push 0x402e3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030e8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x403102
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x403102
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030ee
mov al, 0xa
jmp fcn.00402824
ret

Function at 0x403134
Capabilities:
Terminate process

Disassembly:
cmp dword [0x49701c], 0
je 0x402a4f
call dword [0x49701c]
mov eax, 0xd2
jmp fcn.00403b40
push eax
push ecx
mov eax, dword [eax]
call fcn.00403104
pop ecx
pop eax
je 0x403143
jmp ebx
pop ecx
jmp 0x402a40
Function at 0x40314c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403104
mov eax, ebx
pop ebx
jne 0x403161
pop ecx
jmp 0x402a40
ret

Function at 0x403a1c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4974a4
mov esi, 0x497038
mov edi, 0x49703c
cmp byte [ebx + 0x24], 0
jne 0x403a4b
cmp dword [edi], 0
je 0x403a4b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a3a
cmp dword [0x497040], 0
je 0x403a92
call fcn.00403998
cmp byte [0x497048], 0
je 0x403a78
mov edx, 0x49402c
mov eax, 0x49721c
call fcn.004065b8
call fcn.0040653b
jmp 0x403a8b
push 0
push 0x49404c
push 0x49402c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x497040], eax
cmp byte [ebx + 0x24], 2
jne 0x403aa2
cmp dword [esi], 0
jne 0x403aa2
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040386c
cmp byte [ebx + 0x24], 1
jbe 0x403ab2
cmp dword [esi], 0
je 0x403acf
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403acf
call fcn.00405f74
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403acf
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403844
cmp byte [ebx + 0x24], 1
jne 0x403add
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403ae8
call fcn.004039e8
cmp dword [ebx], 0
jne 0x403af5
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a92

Function at 0x4041b0
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404174
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404174
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x40415c
ret

Function at 0x404258
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402824
test ecx, ecx
je fcn.00404174
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x40415c
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40427c
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x4042af
push edx
cmp cx, word [edx]
je 0x4042a8
cmp cx, word [edx + 2]
je 0x4042a5
cmp cx, word [edx + 4]
je 0x4042a2
cmp cx, word [edx + 6]
je 0x40429f
add edx, 8
jmp 0x404283
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.00404258
Function at 0x4043f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40442f
cmp al, 0xb
je 0x40442f
cmp al, 0xc
je 0x404439
cmp al, 0xd
je 0x40444c
cmp al, 0xe
je 0x40446a
cmp al, 0xf
je 0x40442f
cmp al, 0x11
je 0x40442f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40442f
jmp 0x40447e
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404439
jmp 0x40447e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004043f0
dec edi
jg 0x40444f
pop ebp
jmp 0x40447e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043c4
dec edi
jg 0x40446d
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404484
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004043f0

Function at 0x4044bc
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404503
cmp al, 0xb
je 0x40451d
cmp al, 0xc
je 0x404534
cmp al, 0xd
je 0x404543
cmp al, 0xe
je 0x404561
cmp al, 0xf
je 0x404577
cmp al, 0x11
je 0x404586
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402824
cmp ecx, 1
mov eax, ebx
jg 0x404514
call fcn.00403b4c
jmp 0x404595
mov edx, ecx
call fcn.00403b70
jmp 0x404595
cmp ecx, 1
mov eax, ebx
jg 0x40452b
call fcn.00404174
jmp 0x404595
mov edx, ecx
call fcn.0040418c
jmp 0x404595
mov eax, ebx
add ebx, 0x10
call fcn.00405320
dec edi
jg 0x404534
jmp 0x404595
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004044bc
dec edi
jg 0x404546
pop ebp
jmp 0x404595
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404490
dec edi
jg 0x404564
pop ebp
jmp 0x404595
mov eax, ebx
add ebx, 4
call fcn.0040603c
dec edi
jg 0x404577
jmp 0x404595
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00405bd0
dec edi
jg 0x404586
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x40459c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004044bc