joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4386c7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [esi], 0
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x43870c
and dword [ebp - 8], 0
mov edi, 0x1000000
cmp ebx, edi
ja 0x4386e7
mov edi, ebx
push 0
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438717
mov eax, dword [ebp - 8]
add dword [esi], eax
cmp eax, edi
jb 0x438710
sub ebx, eax
add dword [ebp - 4], eax
test ebx, ebx
jne 0x4386d8
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
xor eax, eax
jmp 0x438713

Function at 0x43871b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x438726
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x4387d8
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x46f4c0]
inc ecx
sub edi, 8
dec esi
jne 0x43873d
pop ebx
test edi, edi
je 0x4387f1
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x46f4c0]
inc ecx
dec edi
jne 0x4387dc
pop esi
not eax
pop edi
ret
Function at 0x440b1d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x440b58

Function at 0x440dcb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00440add
dec esp
push 0x4d
ret 0x458d
Function at 0x44118f
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x441191
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x44118c
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x441176
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x44117e
cmp edx, ebx
jne 0x4412cc
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x44114d
add eax, dword [eax + 4]
jmp 0x44113a
mov dword [ebp + 0xc], ebx
jmp 0x44119c
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4411b4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4411d2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x441230
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x441217
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x441220
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44122a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44120c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x441196
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x44127d
dec eax
je 0x441274
sub eax, 3
je 0x44126b
mov dword [ebp - 4], 0x40
jmp 0x44129a
mov dword [ebp - 4], 4
jmp 0x441280
mov dword [ebp - 4], 0x20
jmp 0x441280
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4412cc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44124c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00440add
mov dword [0xff14fd96], eax
jne 0x4412d7
push 1
push esi
call edi
mov eax, esi
jmp 0x4412d8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44559b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x4455ba
xor eax, eax
jmp 0x4456bd
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4455d4
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4455d9
inc esi
cmp esi, dword [ebp - 4]
jb 0x4455c9
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x4456a7
cmp ecx, 2
jbe 0x445675
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x44569c
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
add edi, 5
mov ebx, ecx
sub ebx, edi
test edx, edx
je 0x445652
and edx, 6
shl edx, 2
mov ecx, edx
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], ecx
inc eax
test al, 0xfe
jne 0x44564d
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
sub ebx, edi
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov byte [esi + 1], bl
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
and bl, 1
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x4455c4
shr edx, cl
test edx, edx
je 0x4455f7
cmp edx, 4
ja 0x44569c
cmp edx, 3
je 0x44569c
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x4455f7
or edx, 8
shr edx, 1
inc edi
jmp 0x4455c4
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0xc]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret

Function at 0x447662
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x487368], 0
push esi
jne 0x4475d5
call fcn.004474fb
test eax, eax
je 0x447618
mov eax, dword [0x487368]
cmp eax, 1
jne 0x4475f6
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x447618
pop esi
ret
push eax
call dword [0x487370]
test eax, eax
jne 0x447660
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x44761c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x487368]
call dword [0x487370]
mov edi, eax
test edi, edi
je 0x447641
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x44765d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x487368]
call dword [0x48736c]
add edi, 0x10
cmp edi, esi
jb 0x447649
mov eax, edi
pop edi
pop esi
ret
jmp 0x4475c2

Function at 0x447788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x484060]
jne 0x447792
repz ret
jmp fcn.0044c45c
Function at 0x45e01b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044c5d4
and dword [ebp - 4], 0
cmp dword [0x487f40], 0
mov ebx, eax
jne 0x45e0cc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45e17d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45e17d
push eax
call fcn.0044c562
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x487f40], eax
call esi
push eax
call fcn.0044c562
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x487f44], eax
call esi
push eax
call fcn.0044c562
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x487f48], eax
call esi
push eax
call fcn.0044c562
pop ecx
mov dword [0x487f50], eax
test eax, eax
je 0x45e0cc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044c562
pop ecx
mov dword [0x487f4c], eax
mov eax, dword [0x487f4c]
cmp eax, ebx
je 0x45e124
cmp dword [0x487f50], ebx
je 0x45e124
push eax
call fcn.0044c5dd
push dword [0x487f50]
mov esi, eax
call fcn.0044c5dd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45e124
test edi, edi
je 0x45e124
call esi
test eax, eax
je 0x45e11b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45e11b
test byte [ebp - 0xc], 1
jne 0x45e124
or dword [ebp + 0x10], 0x200000
jmp 0x45e15d
mov eax, dword [0x487f44]
cmp eax, ebx
je 0x45e15d
push eax
call fcn.0044c5dd
pop ecx
test eax, eax
je 0x45e15d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45e15d
mov eax, dword [0x487f48]
cmp eax, ebx
je 0x45e15d
push eax
call fcn.0044c5dd
pop ecx
test eax, eax
je 0x45e15d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x487f40]
call fcn.0044c5dd
pop ecx
test eax, eax
je 0x45e17d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45e17f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40197a
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov eax, esi
xor edx, edx
push edi
div dword [ebx + 8]
mov eax, dword [ebp + 0xc]
mov edi, edx
add eax, edi
sub esi, edi
push eax
push esi
push 0
push 6
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
lea ecx, [ebx + 0x18]
lea eax, [ebp - 4]
add edi, esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.00401e7d
mov ecx, dword [eax]
mov eax, edi
pop edi
mov dword [ecx + 0x14], esi
pop esi
pop ebx
leave
ret 8

Function at 0x4024e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40253c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40253c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40252e
cmp esi, ecx
jae 0x40253c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40251c
cmp esi, ecx
jae 0x40253c
cmp word [esi], 0
je 0x40253c
mov eax, esi
jmp 0x40253e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40262d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4026c1
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push esi
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x4026b8
test esi, esi
je 0x4026b8
mov ecx, dword [edi]
test ecx, ecx
je 0x4026b3
mov eax, dword [ebp - 4]
test eax, eax
je 0x4026a9
cmp eax, 2
jbe 0x40269b
cmp eax, 7
jne 0x4026a9
test cl, 1
jne 0x4026a9
shr ecx, 1
cmp ecx, 1
jb 0x4026a9
cmp word [esi + ecx*2 - 2], bx
jne 0x4026a9
cmp ecx, 1
jbe 0x4026b8
cmp word [esi + ecx*2 - 4], bx
jne 0x4026a9
jmp 0x4026b8
test cl, 1
jne 0x4026a9
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x4026b8
xor eax, eax
push 0xd
mov word [esi], ax
pop eax
jmp 0x4026ba
xor eax, eax
mov word [esi], ax
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x80004005
call fcn.00401396
int3
Function at 0x402d20
Capabilities:
Read .ini file

Disassembly:
push 0x814
mov eax, 0x412419
call fcn.00411e39
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x810]
push 0x800
push ecx
push eax
mov dword [ebp - 0x818], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push ebx
push 0x400
push eax
push 0x414c10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push eax
mov ecx, esi
call fcn.004038e5
and dword [ebp - 4], 0
mov ecx, esi
push 0x414d74
push 0x414d78
mov dword [ebp - 0x818], 1
call fcn.004035a1
mov eax, esi
call fcn.00411de3
ret

Function at 0x402f08
Capabilities:
Create directory
Get file attributes

Disassembly:
push 8
mov eax, 0x4124ee
call fcn.00411e05
and dword [ebp - 4], 0
call fcn.00401598
push eax
lea ecx, [ebp - 0x10]
call fcn.00401b24
xor ebx, ebx
lea ecx, [ebp + 8]
push 0
inc ebx
push 0x3a
mov byte [ebp - 4], bl
call fcn.0040356c
mov edi, eax
test edi, edi
js 0x402f41
add edi, 2
push edi
push 0x5c
lea ecx, [ebp + 8]
call fcn.0040356c
mov edi, eax
test edi, edi
jns 0x402f60
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403848
jmp 0x402f88
push edi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.00403470
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00403848
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401572
mov esi, dword [ebp - 0x10]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402fa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402fb8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x402fb8
cmp edi, 0xffffffff
je 0x402fba
inc edi
jmp 0x402f41
xor ebx, ebx
lea ecx, [esi - 0x10]
call fcn.00401572
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401572
mov eax, ebx
call fcn.00411dce
ret
Function at 0x403082
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
call fcn.00402830
mov esi, eax
test esi, esi
je 0x40324c
push str.PdhOpenQueryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhAddCounterW
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhCollectQueryData
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhGetFormattedCounterValue
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhRemoveCounter
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhCloseQuery
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40324c
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40324c
test edi, edi
je 0x40324c
cmp dword [esp + 0x14], 0
je 0x40324c
cmp dword [esp + 0x1c], 0
je 0x40324c
test ebx, ebx
je 0x40324c
movsd xmm0, qword [0x416b70]
lea ecx, [esp + 0xc]
xor edx, edx
movsd qword [esp + 0x28], xmm0
push ecx
push edx
push edx
mov ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
call dword [0x414370]
mov eax, dword [esp + 0x24]
call eax
test eax, eax
jne 0x403216
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0
push str.Processor__Total___Processor_Time
push dword [esp + 0x18]
call dword [0x414370]
call esi
test eax, eax
jne 0x403216
push dword [esp + 0xc]
mov ecx, edi
call dword [0x414370]
call edi
test eax, eax
jne 0x403216
xorps xmm0, xmm0
xor esi, esi
movsd qword [esp + 0x20], xmm0
push dword [esp + 0xc]
mov ecx, edi
call dword [0x414370]
call edi
test eax, eax
jne 0x403216
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
push 0
push 0x8200
push dword [esp + 0x1c]
call dword [0x414370]
call dword [esp + 0x24]
test eax, eax
jne 0x403216
movsd xmm0, qword [esp + 0x38]
addsd xmm0, qword [esp + 0x20]
push 0x1f4
movsd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x4031ab
movsd xmm0, qword [esp + 0x20]
divsd xmm0, qword [0x416b68]
movsd qword [esp + 0x28], xmm0
cmp dword [esp + 0x10], 0
je 0x40322f
push dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov ecx, esi
call dword [0x414370]
call esi
cmp dword [esp + 0xc], 0
je 0x403244
push dword [esp + 0xc]
mov ecx, ebx
call dword [0x414370]
call ebx
movsd xmm0, qword [esp + 0x28]
jmp 0x40324f
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053d0
Capabilities:
Get process image filename

Disassembly:
push 0x21c
mov eax, 0x4129f9
call fcn.00411e39
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], ebx
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [edi], eax
push esi
push ebx
mov dword [ebp - 4], ebx
push 0x410
mov dword [ebp - 0x224], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4054e5
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x4054de
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004038e5
mov dword [ebp - 4], 1
push 0x5c
push dword [ebp - 0x21c]
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x21c]
test ecx, ecx
je 0x4054d3
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4054d3
mov eax, dword [eax - 0xc]
inc ecx
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004034b5
mov dword [ebp - 0x224], 3
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.00403848
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00401572
mov eax, dword [ebp - 0x21c]
lea ecx, [eax - 0x10]
mov byte [ebp - 4], bl
call fcn.00401572
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.00411de3
ret
Function at 0x406d78
Capabilities:
Get file size

Disassembly:
push 0x1c
mov eax, 0x412cac
call fcn.00411e05
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.00401598
push eax
lea ecx, [ebp - 0x18]
call fcn.00401b24
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ecx, dword [eax + 0x78]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp eax, ecx
je 0x406e27
push 0
lea ecx, [eax + 0x18]
call fcn.00401a7c
push eax
lea ecx, [ebp - 0x10]
call fcn.004038e5
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406e05
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
test eax, eax
je 0x406dff
add edi, dword [ebp - 0x28]
adc esi, dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401572
lea ecx, [ebp - 0x14]
call fcn.00401b5d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + 0x78]
jne 0x406db3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401572
mov eax, edi
mov edx, esi
call fcn.00411dce
ret 4

Function at 0x408410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x408424
push 0xd
pop eax
jmp 0x408468
push esi
xor eax, eax
push edi
mov dword [ebp - 4], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x408437
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x40842f
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40886f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x412fd5
call fcn.00411ea7
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4088ec
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4088ec
call fcn.004080cf
mov esi, eax
jmp 0x4089f2
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x40890f
call fcn.004080cf
jmp 0x4089e5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x408905
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x408942
mov esi, 0x8007000e
jmp 0x4089e7
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x408a15
jb 0x40895d
cmp eax, 0xffffffff
ja 0x408a15
cmp eax, 0x400
jbe 0x408972
push eax
lea ecx, [ebp - 0x418]
call fcn.0040a55a
jmp 0x408994
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x408994
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x408938
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x408905
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040948c
mov esi, eax
test edi, edi
je 0x4089f2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x408a0b
lea ecx, [ebp - 0x418]
call fcn.0040a550
mov eax, esi
call fcn.00411df4
ret 0x10
push 0x80070216
call fcn.00401396
int3