joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f310
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 2
mov word [ebp - 0x1c], ax
movzx ecx, word [ebp + 0x18]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x1a], ax
mov edx, dword [ebp + 0x14]
mov al, byte [edx]
mov byte [ebp - 0x18], al
mov ecx, dword [ebp + 0x14]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x17], dl
mov eax, dword [ebp + 0x14]
mov cl, byte [eax + 2]
mov byte [ebp - 0x16], cl
mov edx, dword [ebp + 0x14]
mov al, byte [edx + 3]
mov byte [ebp - 0x15], al
push 8
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00493230
add esp, 0xc
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
movsx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_sendto
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
cmp eax, 0xffffffff
je 0x48f3b6
mov ax, word [ebp - 8]
jmp 0x48f3b9
or eax, 0xffffffff
push edx
mov ecx, ebp
push eax
lea edx, [0x48f3e4]
call fcn.00492460
pop eax
pop edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x20
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret

Function at 0x48f410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
movsx edx, word [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_recvfrom
mov word [ebp - 0x2c], ax
movsx edx, word [ebp - 0x2c]
test edx, edx
jle 0x48f4c3
movzx eax, byte [ebp - 0x14]
cmp eax, 0xc0
jne 0x48f48a
movzx ecx, byte [ebp - 0x13]
cmp ecx, 0xa8
jne 0x48f48a
movzx edx, byte [ebp - 0x12]
cmp edx, 1
jne 0x48f48a
movzx eax, byte [ebp - 0x11]
cmp eax, 0x51
jne 0x48f48a
jmp 0x48f4bd
mov ecx, dword [ebp + 0x14]
mov dl, byte [ebp - 0x14]
mov byte [ecx], dl
mov eax, dword [ebp + 0x14]
mov cl, byte [ebp - 0x13]
mov byte [eax + 1], cl
mov edx, dword [ebp + 0x14]
mov al, byte [ebp - 0x12]
mov byte [edx + 2], al
mov ecx, dword [ebp + 0x14]
mov dl, byte [ebp - 0x11]
mov byte [ecx + 3], dl
movzx eax, word [ebp - 0x16]
push eax
call sub.WS2_32.dll_ntohs
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
mov ax, word [ebp - 0x2c]
jmp 0x48f4c5
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x48f4f0]
call fcn.00492460
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x2c
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x4932b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50beb0]
jne 0x4932ba
repz ret
jmp fcn.004a1390

Function at 0x49a4d0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x49a4f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x49a4fa
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x49a511
mov edx, dword [ebp - 4]
push edx
call fcn.0049c4e0
add esp, 4
or eax, 0xffffffff
jmp 0x49a513
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49a520
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x49a53f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x49a546
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x49a55d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049c4e0
add esp, 4
or eax, 0xffffffff
jmp 0x49a55f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1071f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1071f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1071f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071f06a
add dl, dl
jne 0x1071f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071f0dc
xor eax, eax
add dl, dl
jne 0x1071f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071f17d
add dl, dl
jne 0x1071f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1071f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1071f075
mov eax, 1
add dl, dl
jne 0x1071f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071f0e1
sub eax, ebx
mov ebx, 1
jne 0x1071f128
mov ecx, 1
add dl, dl
jne 0x1071f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1071f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1071f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1071f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071f136
cmp eax, 0x7d00
jae 0x1071f16d
cmp eax, 0x500
jb 0x1071f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071f075
cmp eax, 0x7f
ja 0x1071f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1071f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1071f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002000
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10077620], 0
mov byte [0x10077624], 0
mov dword [0x10077618], 0x1ba8
mov dword [0x10077614], 0xd65
mov dword [0x1007761c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10002067
mov dword [0x10077614], 0x1b59
mov dword [0x1007761c], 0
jmp 0x10002097
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1007761c]
add eax, 1
mov dword [0x1007761c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10002067
jmp 0x10002051
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x100
mov dword [0x10077628], 0
mov ecx, dword [0x10077620]
mov edx, dword [0x1007761c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10077628], edi
mov edx, dword [0x10077614]
add edx, 0xfffffb8c
mov dword [0x10077614], edx
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x10077620], edx
mov dword [0x10077618], 0x180f
mov ecx, dword [0x1007761c]
mov bl, byte [esi + ecx]
mov byte [0x10077624], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov dword [0x10077614], 0xec8
mov bl, byte [0x10077624]
mov ecx, dword [0x10077620]
mov byte [esi + ecx], bl
mov ecx, dword [0x1007761c]
add ecx, 1
mov dword [0x1007761c], ecx
cmp ecx, 0x100
jl 0x10002097
jmp 0x1000208f
Function at 0x10002160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [0x10077618], 0x1293
mov dword [ebp - 0x30], eax
call fcn.10002ed0
xor ecx, ecx
mov edx, dword [0x10077618]
add edx, 0xffffe7f9
mov dword [0x10077614], edx
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x1000221c
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
lea edx, section..data
mov esi, eax
shl esi, 8
mov edi, edx
add edi, esi
add edi, 0xb8
mov esi, eax
shl esi, 8
mov ebx, edx
add ebx, esi
mov esi, eax
add esi, 1
shl eax, 8
add edx, eax
add edx, 0xb4
mov eax, dword [ebp - 0x48]
add eax, ecx
mov edi, dword [edi]
mov ebx, dword [ebx]
movzx edx, word [edx]
xor edx, edi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edx
call fcn.10002f40
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
add eax, ecx
mov edx, dword [ebp - 0x4c]
cmp edx, 0x726
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], eax
je 0x100022f7
jmp 0x1000219f
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
mov esi, eax
shl esi, 8
mov edi, edx
add edi, esi
add edi, 0xb8
mov esi, dword [edi]
mov edi, eax
shl edi, 8
add edx, edi
add edx, 0xb4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x726
mov ecx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x1000221c
lea eax, [0x100046fd]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10077618], 0x22bb
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], ecx
call fcn.10002aa0
mov dword [0x10077618], 0xa2b
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call fcn.10001d30
mov ecx, eax
mov dword [0x10077630], eax
mov eax, esp
mov edx, dword [ebp - 0x58]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x10077614]
add edx, 0xfffff67c
mov dword [0x10077614], edx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], ecx
jmp 0x1000219f
mov dword [0x10077614], 0x186b
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x58]
mov dword [esp + 8], ecx
call fcn.10002810
mov eax, dword [ebp - 0x48]
add eax, 0x8156d
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], 0x140c00
mov dword [0x10077614], 0x75c
mov eax, dword [ebp - 0x48]
add eax, 0x5adaa
mov dword [ebp - 0x64], eax
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x64]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x2010
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x10077618], 0x1aab
lea eax, [fcn.10002e70]
mov dword [ebp - 4], eax
jmp 0x10002eaf
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
sete dl
mov byte [ebp - 9], dl
mov al, byte [ebp - 9]
test al, 1
jne 0x10002e8b
jmp 0x10002ebc
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
je 0x10002e93
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x10002eaf

Function at 0x10002fc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10003040
mov dword [0x10077614], 0x127d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10003022
jmp 0x1000310a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100030bc
jmp 0x1000310a
mov dword [0x10077614], 0x21d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000300a
jmp 0x1000310a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x10003074
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], ecx
jl 0x10003040
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x10077614]
add ecx, 0xffffeb30
mov dword [0x10077614], ecx
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1000310a
mov eax, dword [0x10077618]
add eax, 0xffffdc92
mov dword [0x10077614], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002fec
jmp 0x1000310a
mov dword [0x10077614], 0x139c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000310a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x22], dx
mov ax, word [ebp - 0x22]
cmp ax, 0x6c
jne 0x1000310a
mov eax, 1
mov ecx, dword [0x10077618]
add ecx, 0xfffff09a
mov dword [0x10077614], ecx
mov dword [ebp - 0x28], eax
jmp 0x10003119
xor eax, eax
mov dword [0x10077618], 0xda4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret
Function at 0x402e35
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x101f
push dword [0x4074cc]
mov esi, eax
call edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [esi + 4]
lea eax, [ebp - 0x18]
push dword [esi]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x402f6f
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
push dword [0x4074cc]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1012
push dword [0x4074cc]
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x402f6f
push 0x104
push dword [0x4074cc]
mov eax, esi
call fcn.004038e1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x402f6f
push edi
call fcn.0040188e
pop ecx
test eax, eax
je 0x402f6f
cmp esi, 0x106
sete cl
movzx ecx, cl
push ecx
lea edi, [ebp - 8]
call fcn.0040155f
pop ecx
test eax, eax
js 0x402f6f
movzx eax, word [ebp - 8]
add eax, 2
push eax
push 2
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x402f6f
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
movzx ecx, word [ebp - 8]
add ecx, 2
push ecx
push dword [ebp - 4]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push dword [0x4074c8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x402f6f
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push str.Text_copied_to_clipboard.
push dword [0x4074d0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
leave
ret

Function at 0x601042
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
add eax, ecx
fst st(6)
pop ss
pop ecx
add ecx, dword [ecx]
mov al, byte [0x70419124]
fnstenv [edx - 0x5fec9c2e]
mov edx, 0x9996217a
inc ebx
mov byte [0x2a59991f], al
and esp, dword [edi + edi - 0x4bf4ec5d]
xor al, 0xb5
cmp dword [edi - 0x2d82170f], esi
stosd dword es:[edi], eax
push ebx
dec edx
mov edi, 0x51ec618a
invalid
ficomp word [ecx - 0x696e34bd]
push es
jbe 0x600fef
mov byte [ecx], 9
ret 0x932c
Function at 0x4026f8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402706
call dword [0x443024]
or eax, eax
je 0x402707
ret
mov al, 1
jmp fcn.00402784

Function at 0x402710
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40271e
call dword [0x443028]
or eax, eax
jne 0x40271f
ret
mov al, 2
jmp fcn.00402784

Function at 0x402728
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402760
test edx, edx
je 0x40274a
push eax
mov eax, ecx
call dword [0x44302c]
pop ecx
or eax, eax
je 0x402759
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402784
mov dword [eax], edx
mov eax, ecx
call dword [0x443028]
or eax, eax
jne 0x402743
ret
mov al, 1
jmp fcn.00402784
test edx, edx
je 0x402774
push eax
mov eax, edx
call dword [0x443024]
pop ecx
or eax, eax
je 0x402759
mov dword [ecx], eax
ret

Function at 0x402784
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x444004]
test ecx, ecx
je 0x402794
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4027ad]
jns 0x4027a8
call fcn.0040617c
mov eax, dword [eax + 4]
jmp fcn.00403ab8

Function at 0x4027c8
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.0040617c
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4027dd
ret
xor eax, eax
jmp fcn.00402784

Function at 0x402928
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402957
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403bac
jmp 0x402975
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402850
mov edi, eax
test ebx, ebx
je 0x402975
cmp dword [esi], 0
je 0x402975
dec ebx
jmp 0x40295e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cd8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cb8
xor eax, eax
push ebp
push 0x402cb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cf4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402cb8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f58
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f72
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f72
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f5e
mov al, 0xa
jmp fcn.00402784
ret
Function at 0x402fa4
Capabilities:
Terminate process

Disassembly:
cmp dword [0x44401c], 0
je 0x40299b
call dword [0x44401c]
mov eax, 0xd2
jmp fcn.00403ab8
push eax
push ecx
mov eax, dword [eax]
call fcn.00402f74
pop ecx
pop eax
je 0x402fb3
jmp ebx
pop ecx
jmp 0x40298c

Function at 0x402fbc
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f74
mov eax, ebx
pop ebx
jne 0x402fd1
pop ecx
jmp 0x40298c
ret

Function at 0x403828
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, 0x4444a4
lea edi, [ebp - 0x3c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop dword [0x4444c4]
pop dword [0x4444c0]
mov dword [0x4444b8], ebp
mov dword [0x4444bc], ebx
mov dword [0x4444ac], eax
mov dword [0x4444b4], edx
lea ecx, [ebp - 0x3c]
mov dword [0x4444a4], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x403871
mov ecx, dword [eax]
mov dword [0x4444b0], ecx
call fcn.00403720
mov eax, dword [ebp + 0xc]
inc eax
mov byte [0x4444c8], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [0x4444cc], edx
je 0x403894
call dword [ecx + eax*4]
mov edx, dword [esp + 4]
test edx, edx
je 0x4038a1
mov eax, dword [ebp + 0xc]
call edx
cmp dword [0x444020], 0
jne 0x4038b7
mov byte [0x444028], 1
fnstcw word [section.DATA]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.0040398c
call fcn.004037c8
ret 4

Function at 0x40398c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4444a4
mov esi, 0x444038
mov edi, 0x44403c
cmp byte [ebx + 0x24], 0
jne 0x4039bb
cmp dword [edi], 0
je 0x4039bb
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4039aa
cmp dword [0x444040], 0
je 0x403a0b
call fcn.00403908
cmp byte [0x444048], 0
je 0x4039e8
mov edx, 0x443030
mov eax, 0x44421c
call fcn.00405994
call fcn.00405917
jmp 0x403a04
cmp byte [0x443010], 0
jne 0x403a04
push 0
push 0x443050
push 0x443030
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x444040], eax
cmp byte [ebx + 0x24], 2
jne 0x403a1b
cmp dword [esi], 0
jne 0x403a1b
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403768
cmp byte [ebx + 0x24], 1
jbe 0x403a2b
cmp dword [esi], 0
je 0x403a48
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403a48
call fcn.00405334
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403a48
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403740
cmp byte [ebx + 0x24], 1
jne 0x403a56
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403a61
call fcn.00403958
cmp dword [ebx], 0
jne 0x403a6e
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a0b

Function at 0x403aac
Capabilities:
Terminate process

Disassembly:
mov dword [0x444038], eax
jmp fcn.0040398c

Function at 0x4040e8
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.004040ac
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.004040ac
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404094
ret