joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016414
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10016423
and dword [edi], 0
mov edx, 0x1004bf38
call fcn.10016382
mov esi, eax
test esi, esi
je 0x100164c1
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100164b6
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x100164b6
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100164b6
mov ecx, ebx
call fcn.10017b3f
mov dword [ebp + 8], eax
test eax, eax
je 0x100164b6
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x100164a4
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x100fd1e0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x100164bd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x100164b1
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x100164c0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1001abba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c68c8]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x1001ac0a
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.1001ac0d
mov edx, 0x1004bf3c
mov ecx, esi
mov edi, eax
call fcn.10016382
mov esi, eax
test esi, esi
je 0x1001ac09
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x10021a32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100c68c8]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x10021a78
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.10015b61
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.10021ab8
pop edi
pop esi
ret
Function at 0x1003292a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x1004d230]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0x8d8b9697
movaps xmm0, xmmword [0x1004cf50]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0x9e8aaec9
mov dword [esp + 0x28], 0x100ee86
mov al, dl
sub al, 0x3b
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x1003296f
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x100fd62c
call fcn.10028b0e
pop ecx
pop ecx
test al, al
je 0x100329dc
mov eax, dword [0x100fd62c]
sub eax, 0
je 0x100329d1
sub eax, 1
je 0x100329ca
sub eax, 1
je 0x100329c3
sub eax, 1
je 0x100329bc
sub eax, 1
jne 0x100329d8
call fcn.1003b972
jmp 0x100329d8
call fcn.1003bfdc
jmp 0x100329d8
call fcn.1003adea
jmp 0x100329d8
call fcn.1003b466
jmp 0x100329d8
xor ecx, ecx
call fcn.1003a474
mov al, 1
jmp 0x100329de
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1004111d
mov esp, ebp
pop ebp
ret
Function at 0x1003539e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x100353bb
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x100353a9
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x100353bd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x100353da
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x100353c8
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x100353dc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x10035402
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x100353ea
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x10035404
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x10035421
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x1003540f
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x10035423
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x10035440
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x1003542e
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x10035442
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1003545f
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x1003544d
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x10035461
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1003547e
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x1003546c
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x10035480
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x1003549d
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x1003548b
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x1003549f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x100354bc
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x100354aa
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x100354be
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x100354e4
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x100354cc
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x100354e6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x10035503
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3b]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x100354f1
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x10042190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10042340
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004225d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x100421da
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x100421da
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100421aa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10042200
jmp 0x1004225d
cmp dword [ebp - 0x14], 0x10000
jne 0x10042243
cmp dword [ebp - 0x18], 0x10000
jb 0x10042243
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10042236
mov eax, dword [ebp - 8]
jmp 0x1004225f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10042258
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10042340
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100421aa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10042270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10042370
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10042335
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x100422b5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x100422b5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10042285
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100422db
jmp 0x10042335
cmp dword [ebp - 0x14], 0x10000
jne 0x1004231e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004231e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10042311
mov eax, dword [ebp - 8]
jmp 0x10042337
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10042330
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10042370
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10042285
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
mov ecx, 0x432111bd
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x2e2b4ec1
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x4252a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4252b8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42535c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x425357
mov ecx, dword [ebp - 8]
push ecx
call fcn.004257c0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x425316
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x425316
xor eax, eax
jmp 0x42535c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4252af
mov esp, ebp
pop ebp
ret
Function at 0x414ddd
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], ebx
and esi, edx
and edx, eax
dec esi
add ecx, 4
inc eax
cmp ecx, edi
jne fcn.00414ddd
add eax, 0xc0220f59
or esi, eax
ret
Function at 0x61dc30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x167000]
mov dword [edi + 0x16c8fc], 0xb257c891
push edi
jmp 0x61dc5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x61dc61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dc50
mov eax, 1
add ebx, ebx
jne 0x61dc73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x61dc84
jne 0x61dca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dca3
dec eax
add ebx, ebx
jne 0x61dc90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x61dc68
add ebx, ebx
jne 0x61dc9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x61dcf5
xor ecx, ecx
sub eax, 3
jb 0x61dcbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61dd2a
sar eax, 1
mov ebp, eax
jmp 0x61dcc6
add ebx, ebx
jne 0x61dcc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dc94
inc ecx
add ebx, ebx
jne 0x61dcd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dc94
add ebx, ebx
jne 0x61dce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x61dcd6
jne 0x61dcf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x61dcd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61dd14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61dd06
jmp 0x61dc56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61dd14
add edi, ecx
jmp 0x61dc56
pop esi
mov edi, esi
mov ecx, 0x62db
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61dd32
cmp byte [edi], 0x16
jne 0x61dd32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61dd37
lea edi, [esi + 0x211000]
mov eax, dword [edi]
or eax, eax
je 0x61ddaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2aca84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2acc78]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x61dd64
mov ecx, edi
jns 0x61dd93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2acc80]
or eax, eax
je 0x61dda9
mov dword [ebx], eax
add ebx, 4
jmp 0x61dd81
call dword [esi + 0x2acc7c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x61dde0
cmp al, 0xef
ja 0x61ddd3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x61ddb5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x61ddc2
mov ebp, dword [esi + 0x2acc84]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61de14
sub esp, 0xffffff80
jmp 0x4e25e9
Function at 0x4027b0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027be
call dword [0x4d201c]
or eax, eax
je 0x4027bf
ret
mov al, 1
jmp fcn.0040283c

Function at 0x4027c8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027d6
call dword [0x4d2020]
or eax, eax
jne 0x4027d7
ret
mov al, 2
jmp fcn.0040283c

Function at 0x4027e0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402818
test edx, edx
je 0x402802
push eax
mov eax, ecx
call dword [0x4d2024]
pop ecx
or eax, eax
je 0x402811
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040283c
mov dword [eax], edx
mov eax, ecx
call dword [0x4d2020]
or eax, eax
jne 0x4027fb
ret
mov al, 1
jmp fcn.0040283c
test edx, edx
je 0x40282c
push eax
mov eax, edx
call dword [0x4d201c]
pop ecx
or eax, eax
je 0x402811
mov dword [ecx], eax
ret

Function at 0x40283c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x4d5004]
test ecx, ecx
je 0x40284c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402865]
jns 0x402860
call fcn.00406b64
mov eax, dword [eax + 4]
jmp fcn.00403b88

Function at 0x402e18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402eb0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e90
xor eax, eax
push ebp
push 0x402e89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ecc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403130
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40314a
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x40314a
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x403136
mov al, 0xa
jmp fcn.0040283c
ret

Function at 0x40317c
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4d501c], 0
je 0x402a1b
call dword [0x4d501c]
mov eax, 0xd2
jmp fcn.00403b88
push eax
push ecx
mov eax, dword [eax]
call fcn.0040314c
pop ecx
pop eax
je 0x40318b
jmp ebx
pop ecx
jmp 0x402a0c

Function at 0x403194
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.0040314c
mov eax, ebx
pop ebx
jne 0x4031a9
pop ecx
jmp 0x402a0c
ret
Function at 0x403a64
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4d54a4
mov esi, 0x4d5038
mov edi, 0x4d503c
cmp byte [ebx + 0x24], 0
jne 0x403a93
cmp dword [edi], 0
je 0x403a93
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a82
cmp dword [0x4d5040], 0
je 0x403ada
call fcn.004039e0
cmp byte [0x4d5048], 0
je 0x403ac0
mov edx, 0x4d202c
mov eax, 0x4d521c
call fcn.00406400
call fcn.00406383
jmp 0x403ad3
push 0
push 0x4d204c
push 0x4d202c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x4d5040], eax
cmp byte [ebx + 0x24], 2
jne 0x403aea
cmp dword [esi], 0
jne 0x403aea
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004038b4
cmp byte [ebx + 0x24], 1
jbe 0x403afa
cmp dword [esi], 0
je 0x403b17
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403b17
call fcn.00405dd8
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403b17
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.0040388c
cmp byte [ebx + 0x24], 1
jne 0x403b25
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403b30
call fcn.00403a30
cmp dword [ebx], 0
jne 0x403b3d
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403ada

Function at 0x4041f8
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.004041bc
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.004041bc
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4041a4
ret

Function at 0x4042a0
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040283c
test ecx, ecx
je fcn.004041bc
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4041a4
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404368
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4043a7
cmp al, 0xb
je 0x4043a7
cmp al, 0xc
je 0x4043b1
cmp al, 0xd
je 0x4043c4
cmp al, 0xe
je 0x4043e2
cmp al, 0xf
je 0x4043a7
cmp al, 0x11
je 0x4043a7
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040283c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4043a7
jmp 0x4043f6
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4043b1
jmp 0x4043f6
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404368
dec edi
jg 0x4043c7
pop ebp
jmp 0x4043f6
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.0040433c
dec edi
jg 0x4043e5
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4043fc
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404368
Function at 0x40463c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404682
cmp cl, 0xb
je 0x404699
cmp cl, 0xc
je 0x4046ad
cmp cl, 0xd
je 0x4046c1
cmp cl, 0xe
je 0x4046e2
cmp cl, 0xf
je 0x4046ff
cmp cl, 0x11
je 0x404713
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040283c
mov eax, ebx
mov edx, dword [esi]
call fcn.00403be8
add ebx, 4
add esi, 4
dec ebp
jne 0x404682
jmp 0x404727
mov eax, ebx
mov edx, dword [esi]
call fcn.004041f8
add ebx, 4
add esi, 4
dec ebp
jne 0x404699
jmp 0x404727
mov eax, ebx
mov edx, esi
call fcn.004048e4
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4046ad
jmp 0x404727
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.0040463c
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4046ca
jmp 0x404727
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404520
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4046e2
jmp 0x404727
mov eax, ebx
mov edx, dword [esi]
call fcn.00405eb8
add ebx, 4
add esi, 4
dec ebp
jne 0x4046ff
jmp 0x404727
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405a70
add ebx, 4
add esi, 4
dec ebp
jne 0x404713
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4048e4
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.0040283c
cmp eax, edx
je 0x40497b
cmp word [eax], 8
jb 0x40491c
push eax
push edx
cmp word [eax], 0x100
je 0x404912
cmp word [eax], 0x101
je 0x40490a
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x40491a
call dword [0x4d53e8]
jmp 0x40491a
add eax, 8
call fcn.00403b94
pop edx
pop eax
cmp word [edx], 8
jae 0x404933
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40494e
cmp word [edx], 0x101
jne 0x404967
push eax
call 0x404922
pop eax
jmp dword [0x4d53f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x40495e
mov ecx, dword [edx - 8]
inc ecx
jle 0x40495e
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404898
ret

Function at 0x404d7c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404d8a
mov edx, dword [edx + 8]
jmp fcn.004041f8
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404af4
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.004041ac
add esp, 0x10
pop ebx
ret