joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4117c9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448090]
jne 0x4117d3
repz ret
jmp fcn.00413eb5

Function at 0x41d7be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416ce7
and dword [ebp - 0x14], 0
cmp dword [0x44a3a4], 0
mov dword [ebp - 0x18], eax
jne 0x41d871
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41d919
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41d919
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44a3a4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44a3a8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44a3ac], eax
call edi
push eax
call esi
mov dword [0x44a3b4], eax
test eax, eax
je 0x41d871
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44a3b0], eax
mov eax, dword [0x44a3b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41d8ca
cmp dword [0x44a3b4], ecx
je 0x41d8ca
push eax
call esi
push dword [0x44a3b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41d8ca
test ebx, ebx
je 0x41d8ca
call edi
test eax, eax
je 0x41d8c1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41d8c1
test byte [ebp - 8], 1
jne 0x41d8ca
or dword [ebp + 0x10], 0x200000
jmp 0x41d8fd
mov eax, dword [0x44a3a8]
cmp eax, dword [ebp - 0x18]
je 0x41d8fd
push eax
call esi
test eax, eax
je 0x41d8fd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41d8fd
mov eax, dword [0x44a3ac]
cmp eax, dword [ebp - 0x18]
je 0x41d8fd
push eax
call esi
test eax, eax
je 0x41d8fd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44a3a4]
call esi
test eax, eax
je 0x41d919
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41d91b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004117c9
leave
ret
Function at 0x438a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439af9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x448090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [0x44924c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44924c
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, 1
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x438a8c
mov eax, 0x104
mov ecx, esi
call fcn.00404880
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x438abe
push ecx
push eax
call fcn.004130e3
add esp, 8
test eax, eax
js 0x438ae0
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x438ae0
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401b20
int3
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013c8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4013fa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4013f6
cmp esi, eax
jae 0x4013fa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4013e8
cmp esi, eax
jb 0x401400
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x41d620
call fcn.0040820d
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4014c4
test esi, esi
jne 0x4014c4
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x4014a8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4014a2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4014a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x401491
cmp esi, eax
jae 0x401495
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401483
cmp esi, eax
jb 0x401499
xor eax, eax
jmp 0x4014a2
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x4014cd
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x41d620
call fcn.0040820d
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x401435
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov ebx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
or eax, 0x2001f
push edx
call fcn.00401a50
mov ebx, eax
cmp ebx, esi
je 0x401bcd
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401bc6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov eax, ebx
jmp 0x401c6c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x22c]
push edx
push esi
push eax
mov dword [ebp - 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x401c32
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00401b60
mov ebx, eax
cmp ebx, esi
jne 0x401bae
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x1c]
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push esi
push edx
mov dword [ebp - 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401bf5
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401c43
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 0x18], esi
call fcn.004018f0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401c6a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebp - 0x18], esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4153a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x430], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
jne 0x4022ce
call fcn.004014e0
mov edi, eax
jmp 0x4023e1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
jne 0x4022ed
call fcn.004014e0
jmp 0x4023d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x402306
call fcn.004014e0
jmp 0x4023d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp + 0x10], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x402324
mov edi, 0x8007000e
jmp 0x4023da
mov byte [ebp - 4], 2
xor ecx, ecx
shld ecx, eax, 1
mov dword [ebp - 0x1c], ecx
add eax, eax
mov dword [ebp - 0x20], eax
cmp ecx, ebx
ja 0x40233f
cmp eax, 0xffffffff
jbe 0x402349
push 0x80070216
call fcn.00401080
cmp eax, 0x400
jbe 0x402365
lea ecx, [ebp - 0x430]
push ecx
call fcn.00406530
mov dword [ebp - 4], 1
jmp 0x40238f
lea edx, [ebp - 0x42c]
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], 1
jmp 0x40238f
mov eax, dword [ebp - 0x430]
cmp eax, ebx
jne 0x4023a0
mov edi, 0x8007000e
jmp 0x4023da
push edi
push eax
push edi
mov eax, dword [ebp + 0xc]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4023ba
call fcn.004014e0
jmp 0x4023d8
xor ecx, ecx
mov edx, dword [ebp - 0x430]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x430]
lea edx, [ebp - 0x18]
call fcn.00403070
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
cmp dword [ebp - 0x430], ecx
je 0x4023fd
lea eax, [ebp - 0x430]
call fcn.004061c0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00409700
push 3
lea edx, [ebp - 0x44]
push str.IrsDate__d
push edx
mov edx, 0x20
call fcn.00406a70
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.crt.dll_Ordinal_64]
add esp, 0x1c
test al, al
je 0x404b08
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004046c0
mov bl, al
test bl, bl
je 0x404b40
cmp dword [esi + 4], 0
je 0x404b40
lea ecx, [ebp - 4]
push ecx
push 0
push esi
push 0x404b50
push 0
push 0
mov dword [esi + 8], 3
mov dword [ebp - 4], 0
call fcn.00408cce
add esp, 0x18
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404d50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414eb2
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x404e6f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e6f
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
push 0x418ee4
push 0x17
push 0
push 0x418ed4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404e59
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404e59
mov ecx, dword [eax]
mov edx, dword [ecx + 0xfc]
push 0
push eax
call edx
lea esi, [ebp - 0x2c]
call fcn.00401520
mov byte [ebp - 4], 3
mov edi, dword [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx]
lea ecx, [ebp - 0x14]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0xe8]
push edx
call ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or ecx, 0xffffffff
cmp word [ebp - 0x14], cx
je 0x404e2c
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00404170
jmp 0x404e6f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [edx], eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00404170
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404e6f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4057a0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
mov dword [0x41e4c0], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [eax], 0x22
mov ebx, eax
jne 0x4057da
push 0x418d2c
add eax, 2
jmp 0x4057df
push 0x418d30
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
lea esi, [eax + 2]
cmp esi, ebx
jb 0x4057fb
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
cmp esi, eax
jbe 0x4057fd
xor esi, esi
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x418d34
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x41e4f0
mov dword [0x41e6f8], edi
call fcn.00408a3f
add esp, 0xc
mov edx, 0x41e6fc
pop edi
mov eax, esi
sub edx, esi
pop esi
pop ebx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x405850
push 0
mov eax, 1
push 0
push 0x405760
mov dword [0x41eb0c], eax
mov dword [0x41eb10], eax
call fcn.00408826
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4058b0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x4184a8
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4058d5
push eax
push eax
push 0x405890
call fcn.00408826
add esp, 0xc
push esi
call fcn.004044c0
mov esi, eax
test esi, esi
jne 0x4058f9
cmp byte [0x41eb54], al
je 0x405900
call fcn.00405fe0
test eax, eax
jne 0x405900
mov esi, 0x80004005
jmp 0x405900
mov byte [0x41eb54], 0
test esi, esi
jne 0x40590b
call fcn.004060d0
jmp 0x40590d
js 0x405929
call fcn.00404550
cmp byte [0x41eb54], 0
mov esi, eax
je 0x405929
mov eax, dword [0x41eb50]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
ret

Function at 0x405fe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41eb48], eax
test eax, eax
jne 0x405fff
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 4]
push eax
push 0
push 0x41eb18
push 0x4062c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x40602d
mov ecx, dword [0x41eb48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4074d2
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0x407490
call fcn.00408826
add esp, 0xc
xor eax, eax
ret 4

Function at 0x409552
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c090]
jne 0x40955c
repz ret
jmp fcn.0040d3de
Function at 0x40ebcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a199
and dword [ebp - 0x14], 0
cmp dword [0x41e43c], 0
mov dword [ebp - 0x18], eax
jne 0x40ec7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ed26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40ed26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41e43c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41e440], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41e444], eax
call edi
push eax
call esi
mov dword [0x41e44c], eax
test eax, eax
je 0x40ec7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41e448], eax
mov eax, dword [0x41e448]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ecd7
cmp dword [0x41e44c], ecx
je 0x40ecd7
push eax
call esi
push dword [0x41e44c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ecd7
test ebx, ebx
je 0x40ecd7
call edi
test eax, eax
je 0x40ecce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ecce
test byte [ebp - 8], 1
jne 0x40ecd7
or dword [ebp + 0x10], 0x200000
jmp 0x40ed0a
mov eax, dword [0x41e440]
cmp eax, dword [ebp - 0x18]
je 0x40ed0a
push eax
call esi
test eax, eax
je 0x40ed0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ed0a
mov eax, dword [0x41e444]
cmp eax, dword [ebp - 0x18]
je 0x40ed0a
push eax
call esi
test eax, eax
je 0x40ed0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41e43c]
call esi
test eax, eax
je 0x40ed26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ed28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409552
leave
ret
Function at 0x1007a61
Capabilities:
Accept command line arguments
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x100a36c], eax
cmp eax, 0xffffffff
jne 0x1007a9a
push 0x57
pop eax
jmp 0x1007c5f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
push 1
push esi
mov dword [0x100a370], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push esi
push 0x1001648
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
lea eax, [ebp - 0x5ac]
push eax
call dword [sym.imp.ISCSIDSC.dll_GetIScsiVersionInformation]
test eax, eax
jne 0x1007aec
push 0x1db0
push dword [ebp - 0x5a8]
push dword [ebp - 0x5ac]
push 0x48b
call fcn.010031d9
add esp, 0x10
lea eax, [ebp - 0x59c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x5a0], eax
cmp eax, esi
jne 0x1007c28
cmp dword [ebp + 8], 1
push ebx
push edi
jne 0x1007c0c
push dword [sym.imp.msvcrt.dll__iob]
call dword [sym.imp.msvcrt.dll_feof]
pop ecx
test eax, eax
jne 0x1007c1e
mov edi, 0x1000
mov ebx, 0x100a380
mov esi, 0x100c380
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ISCSIDSC.dll_GetIScsiInitiatorNodeNameW]
mov dword [ebp - 0x5a0], eax
test eax, eax
jne 0x1007bd9
lea eax, [ebp - 0x204]
push eax
push 0x48c
call fcn.010031d9
push dword [sym.imp.msvcrt.dll__iob]
push edi
push ebx
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0x14
test eax, eax
je 0x1007bc2
push 0x1002448
push edi
push esi
call fcn.01003034
push ebx
push edi
push esi
call fcn.0100306e
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1007b96
sub eax, ecx
sar eax, 1
lea eax, [eax*2 + 0x100c37e]
cmp word [eax], 0xa
jne 0x1007bb6
xor ecx, ecx
mov word [eax], cx
push esi
call fcn.01007477
mov dword [ebp - 0x5a0], eax
push dword [sym.imp.msvcrt.dll__iob]
call dword [sym.imp.msvcrt.dll_feof]
pop ecx
test eax, eax
je 0x1007b3c
jmp 0x1007c1e
push eax
push 0x104
lea eax, [ebp - 0x40c]
push eax
call fcn.01003741
push eax
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x48d
call fcn.01002613
push eax
push 0x10018f4
call fcn.01003127
add esp, 0xc
jmp 0x1007c1e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01007477
mov dword [ebp - 0x5a0], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop ebx
jmp 0x1007c59
push eax
push 0x104
lea eax, [ebp - 0x40c]
push eax
call fcn.01003741
push eax
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x48f
call fcn.01002613
push eax
push 0x10018f4
call fcn.01003127
add esp, 0xc
mov eax, dword [ebp - 0x5a0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01007fd9
leave
ret
Function at 0x4e48bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e48f1
xchg cx, di
jmp 0x4e4905
mov dh, byte [esp + 1]
mov esi, dword [esp + 0x30]
mov edx, 0x7c5ef0c
cpuid
mov bl, byte [esp]
jmp 0x4e48db
lea edi, [esp + 4]
neg ah
jmp 0x4e4989
lea ebx, [edx + edi]
mov bx, bp
jmp 0x4e4942
jno 0x4e4911
lea ebx, [edx + edi]
lea ecx, [edx + 0x69]
jmp 0x4e4958

Function at 0x715b86
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x19
xchg ch, dl
std
xchg al, cl
pop si
xchg dword [esp], edx
jmp 0x715b43
dec si
mov dl, byte [esp + 5]
xchg esi, eax
sub esp, 0xa
mov ah, byte [esp + 4]
cpuid
jmp 0x715b04
cmc
bt bx, bp
not al
sub esp, 0xd
lea esp, [esp + 4]
cmc
jmp 0x715b68
pop eax
mov ecx, dword [esp]
pop cx
xchg si, di
xchg bh, ah
rdtsc
jmp 0x715b2d
pop ax
lea edi, reloc.WSOCK32.dll___WSAFDIsSet
xchg byte [esp], ch
mov byte [esp], cl
jmp 0x715c65
xchg word [esp + 4], si
xchg bx, ax
or si, ax
cpuid
bsr ebx, ecx
mov ecx, 0x9b250b39
jmp 0x715b52
pushfd
jmp 0x715b1b
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
mov dh, byte [esp + 3]
mov dword [esp], ecx
bswap eax
sub esp, 0x18
neg cx
jmp 0x715bcd
mov ax, word [esp + 1]
std
rol di, cl
lea edi, [ebp*4]
rdtsc
pop word [esp + 1]
jmp 0x715b89
mov edx, dword [esp + 9]
mov word [esp + 0x12], sp
cpuid
pop word [esp + 0x13]
setne ah
jmp 0x715c30
lea edx, [esi + edi]
and ch, 0xc4
shr ah, 0
dec eax
add esp, 1
mov ecx, edx
jmp 0x715bb4
cpuid
xchg bp, bx
pop cx
mov ch, byte [esp + 0xd]
cpuid
jmp 0x715c45
mov cx, word [esp]
mov word [esp + 2], dx
mov word [esp], di
neg ax
push esp
pushfd
jmp 0x715bf9
add esp, 0xc
mov dh, byte [esp + 4]
ror cx, 0xd
cpuid
xchg si, bx
mov si, di
jmp 0x715c0f
lea esp, [esp + 4]
xchg dword [esp + 8], eax
xchg dl, ch
setae ch
push dword [esp + 9]
pop edi
jmp 0x715c96
mov dword [esp], ecx
bts bx, si
mov bx, word [esp + 6]
ror di, 0xf
neg ax
bts eax, ebp
jmp 0x715be8
pop eax
neg bl
inc bx
not esi
bts dx, cx
mov cx, 0xdd55
jmp 0x715cbc
rdtsc
neg bl
bsr dx, cx
stc
shl di, 0xf
stc
jmp 0x715c80
bsf bx, bp
bsr ecx, esp
sub esp, 0x1e
lea esp, [esp + 0x41]
jmp 0x715d10
mov dh, byte [esp + 5]
mov word [esp], di
shl si, 0
mov dx, 0x68dc
sub esp, 0x15
push word [esp + 0x14]
jmp 0x715ca6
lea eax, [ecx*4]
xchg ebx, eax
setno bh
not ch
rdtsc
xchg bx, si
jmp 0x715cf8
Function at 0x715ef8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, dl
mov ah, bl
lea esp, [esp + 0x12]
mov ecx, dword [esp + 2]
jmp 0x715f17

Function at 0x71af5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], dl
mov dword [esp], esp
push ebp
jmp 0x71afad
pushal
mov dword [esp], ebx
push dword [esp + 0x1b]
mov dword [esp + 0x20], esi
push eax
call fcn.0071af97

Function at 0x71af72
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp], ebx
call fcn.0071af5c
mov ecx, 0x39caaf3f
lodsd eax, dword [esi]
xchg ecx, eax
adc byte [esi + 0xda610e1], al
pushfd
out dx, eax
mul cl
and byte [esi + 0x51], ah

Function at 0x71af97
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.0071a256
pop dword [esp]
jmp 0x71afbf
push si
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x71b029
mov eax, dword [eax]
jmp 0x71b09f
mov ebp, eax
lea ebp, [ebp + 0x1c]
mov eax, dword [ebp]
pop ebp
jmp 0x71aff6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
push ebp
jmp 0x71b00c
lea esp, [esp + 4]
jmp 0x71a251
mov eax, dword [eax + 8]
pushfd
mov dword [esp], eax
pushfd
jmp 0x71b04b