joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405150
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x30
mov dword [ebp - 0xc], 0
call fcn.00404fd0
test eax, eax
je 0x405180
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
add ebx, dword [ebp + 8]
sub esp, 0x18
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x405210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [eax*4]
lea eax, [ebp - 0x24]
lea esi, [ecx + ebx]
mov ecx, edx
lea edx, [ebp - 0x20]
sub esp, 0x3c
add ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 0x20], 0
call fcn.00404fd0
test eax, eax
jne 0x405277
mov eax, dword [ebp - 0x20]
cmp eax, 2
je 0x405280
mov dword [esi], 0xf
cmp eax, 2
je 0x4052c8
xor eax, eax
test edi, edi
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x405254
jmp 0x40525a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40525f
jmp 0x405268
Function at 0x405310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
push ebx
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
sub esp, 0x64
mov dword [ebp - 0x40], 0
call fcn.00404fd0
test eax, eax
je 0x405350
mov ecx, str.Settings
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
call fcn.00404fd0
test eax, eax
je 0x405408
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowPlacement]
xor eax, eax
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 8
cmp dword [ebp - 0x2c], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x38]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp], eax
call fcn.00402e00
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x405332
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.00402ec0
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret

Function at 0x405430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
call fcn.00404fd0
test eax, eax
je 0x405490
test ebx, ebx
je 0x40547a
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40545b
cmp dword [ebp - 0xc], 0x10
jne 0x40545b
jmp 0x40547a
Function at 0x4054d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
call fcn.00404fd0
test eax, eax
je 0x405518
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x4054fb
cmp dword [ebp - 0xc], 4
jne 0x4054fb
jmp 0x405501
Function at 0x405a90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
push ebx
sub esp, 0x9c
call fcn.00404fd0
test eax, eax
je 0x405ac8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00405560
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov esi, 0x3ed
lea edi, [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetMenu]
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x44], 0x20
sub esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x7c], ebx
mov ebx, esi
mov esi, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.user32.dll_GetMenuItemInfoW]
sub esp, 0x10
test eax, eax
je 0x405b47
mov eax, dword [ebp - 0x28]
mov dword [ebp + ebx*4 - 0x100c], eax
add ebx, 1
cmp ebx, 0x3f1
jne 0x405b12
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x7c]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x405c40
xor edi, edi
mov eax, esi
mov esi, edi
mov edi, eax
mov eax, dword [ebp + esi*4 - 0x58]
test eax, eax
je 0x405b9c
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
test eax, eax
je 0x405c5f
add esi, 1
cmp esi, 4
jne 0x405b75
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x405bb5
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x54], eax
mov edx, ebx
mov edi, dword [sym.imp.user32.dll_wsprintfW]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x64]
test ebx, ebx
je 0x405c40
add edx, 1
mov dword [esp + 4], str.File_d
mov dword [esp + 8], edx
mov dword [ebp - 0x7c], edx
mov dword [esp], esi
call edi
cmp word [ebx], 0
mov edx, dword [ebp - 0x7c]
je 0x405c58
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405bf0
sub eax, ebx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x7c]
sub esp, 0x18
cmp edx, 4
je 0x405c40
mov ebx, dword [ebp + edx*4 - 0x58]
jmp 0x405bc3
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x405ab0
mov eax, 2
jmp 0x405bfe
test esi, esi
je 0x405bb5
lea eax, [ebp - 0x58]
lea edx, [esi*4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memmove
jmp 0x405bb5
Function at 0x405d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call fcn.00405210
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp fcn.00405210

Function at 0x405d70
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call fcn.00405150
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp fcn.00405150
Function at 0x407760
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x6fc]
push ebx
sub esp, 0x71c
mov eax, dword [0x41f708]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call edi
mov dword [ebp - 0x710], edi
sub esp, 8
mov dword [ebp - 0x714], eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call edi
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
lea edx, [ebp - 0x6f8]
mov ecx, 0x1c
mov dword [ebp - 0x6fc], 0x74
mov edi, edx
mov dword [ebp - 0x70c], eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x41f704]
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x612]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x70c]
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], ecx
call ebx
sub esp, 0x10
test eax, eax
jne 0x407848
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_lstrcmpW]
lea edi, [ebp - 0x6e2]
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [ebp - 0x718], edx
call edx
sub esp, 8
mov esi, eax
test eax, eax
je 0x4078c0
mov ecx, dword [ebp - 0x70c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp], ecx
mov dword [esp + 4], 0xc
call ebx
mov eax, dword [ebp - 0x714]
mov edi, dword [ebp - 0x710]
sub esp, 0x10
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call edi
sub esp, 8
call fcn.004072c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x41f708]
mov edi, dword [ebp - 0x710]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call edi
lea edi, [ebp - 0x684]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
mov ecx, 0x1c
lea edx, [ebp - 0x688]
mov dword [ebp - 0x688], 0x74
mov dword [ebp - 0x70c], eax
mov eax, esi
sub esp, 0x10
lea esi, [ebp - 0x216]
rep stosd dword es:[edi], eax
mov eax, dword [0x41f704]
mov dword [esp + 0xc], edx
lea edi, [ebp - 0x414]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x70c]
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x67c]
mov edx, 0x66666667
sub esp, 0x10
mov eax, ecx
sar ecx, 0x1f
mov dword [esp + 4], 0x411cf8
imul edx
mov dword [esp], esi
sar edx, 3
sub edx, ecx
mov dword [esp + 8], edx
call dword [sym.imp.user32.dll_wsprintfW]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x718]
mov dword [esp], edi
call eax
sub esp, 8
test eax, eax
je 0x40783d
mov eax, dword [ebp - 0x70c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40783d
Function at 0x4079f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [0x41f708]
mov dword [esp + 4], 0x7d0
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 8
test ebx, ebx
je 0x407a48
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call fcn.00405c90
mov ebx, dword [ebp - 4]
or dword [eax*4 + 0x41f6e8], 2
leave
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call fcn.00405c90
mov ebx, dword [ebp - 4]
and dword [eax*4 + 0x41f6e8], 0xfffffffd
leave
ret
Function at 0x407d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x5c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x407f00
mov edx, eax
lea esi, [ebp - 0x24]
cmp ebx, 0x11
je 0x407eb0
mov eax, dword [0x41f704]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x40], edx
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x1c], 0x406710
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x40]
sub esp, 0x10
mov dword [ebp - 0x3c], eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x41f704]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov ecx, dword [ebp - 0x3c]
sub esp, 4
test ecx, ecx
je 0x407e70
xor eax, eax
movzx edx, word [edi + eax]
add eax, 2
mov word [eax + 0x41f4de], dx
test dx, dx
jne 0x407de0
mov eax, 0x41f4e0
call fcn.00407a80
mov eax, dword [0x41f704]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call esi
mov dword [0x410284], ebx
sub esp, 0x10
call fcn.00407c20
call fcn.00405f20
mov eax, dword [0x410284]
mov dword [esp], eax
call fcn.00405c90
mov eax, dword [eax*4 + 0x41f6f0]
mov dword [esp + 4], eax
mov eax, dword [0x41f708]
mov dword [esp], eax
call fcn.00402f80
mov ecx, 1
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [esp + 8], eax
mov eax, dword [0x41f704]
mov dword [ebp - 0x28], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call esi
mov ecx, dword [ebp - 0x3c]
sub esp, 0x10
test eax, eax
je 0x407dde
jmp 0x407e5c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x411b24
mov dword [esp], eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x3c]
sub esp, 0x14
cmp dword [ebp - 0x24], 2
je 0x407d80
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411d18
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x41f708]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
xor ecx, ecx
sub esp, 0x10
jmp 0x407e5c
Function at 0x408110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
cmp word [0x41f4e0], 0
jne 0x408168
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 8], eax
mov eax, dword [0x41f704]
mov dword [ebp - 0xc], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
je 0x408270
mov eax, dword [0x41f704]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb8
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
je 0x408270
cmp word [0x41f4e0], 0
movzx eax, word [0x41eaa0]
mov ebx, 0x41eaa0
jne 0x408280
test ax, ax
je 0x4082c8
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4081c0
sub eax, ebx
sar eax, 1
cmp word [0x41e8a0], 0
je 0x4081f3
mov edx, 0x41e8a0
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4081e0
sub edx, 0x41e8a0
sar edx, 1
add eax, edx
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov esi, eax
test eax, eax
je 0x40830c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x41e8a0
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [0x41f708]
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x33
mov dword [esp + 8], 0x411d18
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
sub esp, 0x10
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 6
je 0x4082d0
xor eax, eax
cmp ebx, 7
sete al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x41f4e0
lea esi, [esi]
add ebx, 2
cmp word [ebx], 0
jne 0x408288
cmp ebx, 0x41f4e0
jbe 0x4082c8
lea esi, [esi]
movzx eax, word [ebx]
cmp ax, 0x5c
je 0x408300
cmp ax, 0x2f
je 0x408300
sub ebx, 2
movzx eax, word [ebx]
cmp ebx, 0x41f4e0
ja 0x4082a0
jmp 0x4081af
xor eax, eax
jmp 0x4081cd
cmp word [0x41f4e0], 0
je 0x4082f0
mov edx, dword [0x410284]
lea esp, [ebp - 8]
mov eax, 0x41f4e0
pop ebx
pop esi
pop ebp
jmp fcn.00407d20
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp fcn.00407f50
movzx eax, word [ebx + 2]
add ebx, 2
jmp 0x4081af
xor eax, eax
jmp 0x408260
Function at 0x40f120
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x40f190
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0040f4d0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]

Function at 0x40f4d0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call fcn.0040f1d0
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40f55f
cmp al, 9
je 0x40f550
cmp al, 0x20
je 0x40f550
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x40f5b8
cmp al, 0x22
je 0x40f5c8
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x40f55f
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40f510
test edi, 1
jne 0x40f510
lea esi, [esi]
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x40f550
cmp al, 0x20
je 0x40f550
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40f57a
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040def0
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x40f527
and dword [ebp - 0x6c], 1
jne 0x40f520
xor edi, 1
jmp 0x40f527
Function at 0x7031b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00703140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00703140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00703140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00703140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x703bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x703c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x71587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x703c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x703c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x318729bf
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x18d86173
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219