joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4babd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x4badd1
cmp dword [esp + 0x2f8], 0
je 0x4badd1
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00497680
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x4d35fc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bad98
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4bad8b
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bad59
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4bad4e
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00497680
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.004baac0
add esp, 0x14
test eax, eax
je 0x4bad4e
cmp byte [esp + 0x24], 0
je 0x4bad12
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x4bad4e
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x4bad41
mov cl, byte [esi + eax]
test cl, cl
je 0x4bad41
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4bad26
jmp 0x4bad45
test edx, edx
jne 0x4bad46
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4bac70
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x4badd1
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.00419590
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.00497941
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x2ec
ret
Function at 0x4bb040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x4bb1bd
cmp ebp, 0x20
jb 0x4bb1bd
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.00497680
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x4d366c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4bb1bd
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bb0d0
sub eax, edx
cmp eax, 0x40
jne 0x4bb1bd
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x4bb10e
mov cl, byte [esi + eax]
test cl, cl
je 0x4bb10e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4bb0f6
jmp 0x4bb112
test edx, edx
jne 0x4bb113
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x4bb14b
mov cl, byte [edx + eax]
test cl, cl
je 0x4bb14b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x4bb130
jmp 0x4bb14f
test esi, esi
jne 0x4bb150
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.00497680
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.004ba240
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x4bb1bd
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00419590
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.00497941
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x50c
ret

Function at 0x4bb1e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.00497680
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.004ba240
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4bb24b
mov cl, byte [esi + eax]
test cl, cl
je 0x4bb24b
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4bb230
jmp 0x4bb24f
test edx, edx
jne 0x4bb250
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.004ba150
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bb276
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x4d366c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00497941
add esp, 0x188
ret
Function at 0x4bd2b0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4be7b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x4bcb80
push 0x4fd7f0
call fcn.004bcdc0
mov eax, dword [0x4fd7f8]
add esp, 8
test eax, eax
je 0x4bd30a
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.00497468
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.00439c30
int3

Function at 0x4bd340
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4be7e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4fd7f8]
test eax, eax
jne 0x4bd372
xor esi, esi
jmp 0x4bd37b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x4bd3a7
cmp dword [esi + 0x14], 0
jne 0x4bd3e9
cmp dword [esi + 0x10], 0
jne 0x4bd3f0
push 0
call fcn.004bd2b0
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x4bd3d5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4bd3d5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4bd430
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4bd41e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4bd3f0
cmp dword [esi + 0x14], 0
je 0x4bd397
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4bd455
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x4bd486
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4bd486
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4bd486
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4bd43a
jmp 0x4bd391
Function at 0x4bd520
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4be838
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4bd4a0
push 0
push 0
call fcn.0049befe
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4bd58b
lea ecx, [esp + 0x10]
call fcn.00497468
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00439c30
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x4bd5b1
cmp eax, 0xffffffff
je 0x4bd5b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40596d
pop dword [ebp - 4]
mov eax, 0x40596d
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x993ae89d
sub dword [ebp - 0x14], 0x4ae8a352
mov dword [ebp - 0x10], 0xeff1c775
add dword [ebp - 0x10], 0x424184d0
mov dword [ebp - 0xc], 0x56e7ee31
sub dword [ebp - 0xc], 0xa9baa03
mov dword [ebp - 8], 0xd6370c6c
add dword [ebp - 8], 0x29c8f394
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x1265e67b
add dword [ebp - 0x14], 0x620c82db
mov dword [ebp - 0x10], 0xa4533cfd
add dword [ebp - 0x10], 0x9d192478
mov dword [ebp - 0xc], 0xcc09e360
add dword [ebp - 0xc], 0x9765890c
mov dword [ebp - 8], 0xc220dad3
add dword [ebp - 8], 0x3ddf252d
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x39381a6c
sub eax, 0x38f7a96c
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3b207
push 0
call eax
mov ecx, 0xe27a224d
add ecx, 0x1d863757
mov ebx, eax
mov esi, 0x6e9e5beb
add esi, 0x91a2a415
add esi, dword [ebp - 4]
mov edx, 0xd834ed12
mov edi, dword [esi]
xor edi, edx
mov dword [ebx], edi
add ebx, 4
add esi, 0x37ea74d7
sub esi, 0x37ea74d3
loop 0x405a7f
add eax, 0xd227f545
add eax, 0x2dd9641e
xor ebx, ebx
add ebx, eax
add eax, 0x18281e70
add eax, 0xe7d7e195
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], str.Usage:_eject___u____a____h___x:_..._n
call fcn.00401060
mov dword [esp], str._____a__Eject_all_the_CD_drives_we_find_n
call fcn.00401060
mov dword [esp], str._____h__Display_this_help_message_n
call fcn.00401060
mov dword [esp], str._____u__Unmount_only__dont_eject_the_CD_n
call fcn.00401060
mov dword [esp], str.____x:__Eject_drive_x:_n
call fcn.00401060
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_exit]
nop
Function at 0x401d90
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x401e00
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___argv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00401e30
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x403351
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [edi + 4]
xor ebx, ebx
cmp dword [0x2803900], 0x594
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], eax
jne 0x40339e
push 0x402df8
push 0x402e04
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x402e18
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x80b4a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x80b4ac]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00403347
mov eax, dword [0x80b4b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x80b4b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x4033dc
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x2803900], 0xc
mov dword [ebp - 4], eax
jne 0x403441
push ebx
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc4c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2803900]
cmp eax, 0xfa9
jne 0x40345d
mov dword [0x2802e9c], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40346a
mov dword [0x280284c], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
add eax, esi
shr esi, cl
mov dword [ebp - 0x14], eax
mov dword [0x2802e98], 0xf4ea3dee
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor esi, dword [ebp - 4]
cmp dword [0x2803900], 0x213
mov dword [ebp - 0x14], esi
jne 0x4034a7
push 0x402e30
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + edx]
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x18]
call fcn.0040334e
add dword [ebp - 0x10], 0x61c88647
dec dword [ebp - 0x20]
jne 0x4033d9
cmp dword [0x2803900], 0xa6d
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
jne 0x403513
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40351d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2803900]
mov ecx, dword [0x2802850]
sub esp, 0x544
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403590
mov edi, ecx
mov ebx, eax
cmp dword [0x2803900], 0x959
jne 0x403584
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402e44
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.00403351
add edi, 8
dec ebx
jne 0x403541
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40395f
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x2803900], 0x400
push edi
jne 0x4039b1
push esi
push esi
call fcn.00403c46
push esi
push esi
call fcn.00403c46
push esi
push esi
push esi
call fcn.0040460d
add esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00403322
fstp st(0)
push esi
call fcn.00404692
pop ecx
push esi
call fcn.00404424
pop ecx
mov eax, dword [0x80bb34]
mov dword [0x2803900], eax
mov eax, dword [0x80bb0c]
mov dword [0x2803904], eax
call fcn.00403664
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x403a18
cmp dword [esp + 0x18], 0x785074d5
jne 0x403a26
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x4039d3
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x40319c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4031d8
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x403a55
cmp dword [esp + 0x18], 0x785074d5
jne 0x403a5e
inc edi
cmp edi, 0x11915
jl 0x403a28
mov eax, dword [0x2802850]
mov dword [0x2802e94], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40a0c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80ae24]
jne 0x40a0ce
repz ret
jmp fcn.0040d884
Function at 0x40d431
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405f83
and dword [ebp - 4], 0
cmp dword [0x80c458], 0
mov ebx, eax
jne 0x40d4e2
push 0x402ca4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d593
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c98
push edi
call esi
test eax, eax
je 0x40d593
push eax
call fcn.00405f11
mov dword [esp], 0x402c88
push edi
mov dword [0x80c458], eax
call esi
push eax
call fcn.00405f11
mov dword [esp], 0x402c74
push edi
mov dword [0x80c45c], eax
call esi
push eax
call fcn.00405f11
mov dword [esp], 0x402c58
push edi
mov dword [0x80c460], eax
call esi
push eax
call fcn.00405f11
pop ecx
mov dword [0x80c468], eax
test eax, eax
je 0x40d4e2
push 0x402c40
push edi
call esi
push eax
call fcn.00405f11
pop ecx
mov dword [0x80c464], eax
mov eax, dword [0x80c464]
cmp eax, ebx
je 0x40d53a
cmp dword [0x80c468], ebx
je 0x40d53a
push eax
call fcn.00405f8c
push dword [0x80c468]
mov esi, eax
call fcn.00405f8c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d53a
test edi, edi
je 0x40d53a
call esi
test eax, eax
je 0x40d531
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d531
test byte [ebp - 0xc], 1
jne 0x40d53a
or dword [ebp + 0x10], 0x200000
jmp 0x40d573
mov eax, dword [0x80c45c]
cmp eax, ebx
je 0x40d573
push eax
call fcn.00405f8c
pop ecx
test eax, eax
je 0x40d573
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d573
mov eax, dword [0x80c460]
cmp eax, ebx
je 0x40d573
push eax
call fcn.00405f8c
pop ecx
test eax, eax
je 0x40d573
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80c458]
call fcn.00405f8c
pop ecx
test eax, eax
je 0x40d593
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d595
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4093f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x409407
pop dword [ebp - 0x10]
mov eax, 0x615baceb
add eax, 0x9ee4e71c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x113c6c1c
sub dword [ebp - 0x20], 0xc2ea26d1
mov dword [ebp - 0x1c], 0xc43bb912
add dword [ebp - 0x1c], 0x6df79333
mov dword [ebp - 0x18], 0x2ec9c8b0
add dword [ebp - 0x18], 0x1d827b7e
mov dword [ebp - 0x14], 0x18394c34
add dword [ebp - 0x14], 0xe7c6b3cc
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1c6c57ee
sub eax, 0x1c2b87a2
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9c68d67a
add dword [ebp - 0x20], 0xd80992dc
mov dword [ebp - 0x1c], 0x81333245
add dword [ebp - 0x1c], 0xc0392f30
mov dword [ebp - 0x18], 0x132e1e6
add dword [ebp - 0x18], 0x623c8a86
mov dword [ebp - 0x14], 0xa73e75b1
sub dword [ebp - 0x14], 0xa73e75b1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc198ace4
add eax, 0x3ea82364
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3776e
push 0
call eax
mov ecx, 0x8b933e3b
add ecx, 0x746d01bb
xor ebx, ebx
add ebx, eax
mov esi, 0x63883e82
add esi, 0x9cb9717e
add esi, dword [ebp - 0x10]
mov edi, 0xae0fda3a
sub edi, 0x5b17e6ef
mov edx, dword [esi]
add dword [ebp - 8], 0x80d04e4e
xor edx, edi
xor dword [ebp - 4], ecx
mov dword [ebx], edx
sub dword [ebp - 4], 0xecd6bb09
add ebx, 4
add esi, 4
loop 0x40952b
add eax, 0xf2ab
mov ebx, eax
add eax, 0xe67ee818
sub eax, 0xe67ee813
mov ecx, 0x3e66d09a
add ecx, 0xc1d92f66
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401d9d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edi, dword [0x404050]
cdq
or di, 1
idiv edi
mov edx, dword [0x404050]
mov ebx, esi
add edx, eax
mov eax, 0x404054
call fcn.00401cc0
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x403135
push eax
sub edi, fcn.004028df
push edi
push fcn.004028df
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401e13
mov eax, fcn.004028df
mov ebx, esi
mov edx, edi
call fcn.00401cc0
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402423
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret