joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401053
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x3b4]
sub esp, 0x434
mov eax, dword [0x40f430]
xor eax, ebp
mov dword [ebp + 0x3b0], eax
push edi
mov edi, dword [ebp + 0x3bc]
push edi
mov dword [0x410bbc], edi
call fcn.00401148
push edi
call fcn.004011b8
test eax, eax
pop ecx
pop ecx
je 0x401130
push esi
lea eax, [ebp - 0x64]
push eax
xor esi, esi
push esi
push edi
push 0x40134e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x4010e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4010ce
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x4010ba
mov eax, dword [ebp - 0x78]
jmp 0x40112f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Main::CreateThread___failure.
push str._s__code:_0x_08X_
mov eax, 0x410
lea edi, [ebp - 0x60]
call fcn.00401000
mov eax, dword [0x410020]
mov eax, dword [eax]
push 0x5c
push eax
call fcn.0040169c
add esp, 0x14
cmp eax, esi
jne 0x40111d
mov eax, dword [0x410020]
mov eax, dword [eax]
jmp 0x40111f
inc eax
inc eax
push 0x10
push eax
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x3b0]
xor ecx, ebp
pop edi
call fcn.00401a49
add ebp, 0x3b4
leave
ret 0x10

Function at 0x401a49
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f430]
jne 0x401a53
repz ret
jmp fcn.00403728
Function at 0x4028a5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40f1a0]
je 0x4028c0
inc edi
cmp edi, 0x17
jb 0x4028b1
cmp edi, 0x17
jae 0x402a40
push ebp
push 3
call fcn.00406900
cmp eax, 1
pop ecx
je 0x402a0c
push 3
call fcn.00406900
test eax, eax
pop ecx
jne 0x4028f4
cmp dword [0x40f020], 1
je 0x402a0c
cmp ebx, 0xfc
je 0x402a3f
push 0x40c858
mov ebx, 0x314
push ebx
mov ebp, 0x410068
push ebp
call fcn.0040689b
add esp, 0xc
test eax, eax
je 0x40292a
push esi
push esi
push esi
push esi
push esi
call fcn.0040214a
add esp, 0x14
push 0x104
mov esi, 0x410081
push esi
push 0
mov byte [0x410185], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40296e
push 0x40c840
push 0x2fb
push esi
call fcn.0040689b
add esp, 0xc
test eax, eax
je 0x40296e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040214a
add esp, 0x14
push esi
call fcn.004062a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4029b3
push esi
call fcn.004062a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41037c
push 0x40c83c
sub ecx, eax
push ecx
push eax
call fcn.004067e8
add esp, 0x14
test eax, eax
je 0x4029b3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040214a
add esp, 0x14
jmp 0x4029b5
xor esi, esi
push 0x40c838
push ebx
push ebp
call fcn.00406777
add esp, 0xc
test eax, eax
je 0x4029d5
push esi
push esi
push esi
push esi
push esi
call fcn.0040214a
add esp, 0x14
push dword [edi*8 + 0x40f1a4]
push ebx
push ebp
call fcn.00406777
add esp, 0xc
test eax, eax
je 0x4029f7
push esi
push esi
push esi
push esi
push esi
call fcn.0040214a
add esp, 0x14
push 0x12010
push 0x40c810
push ebp
call fcn.004065ba
add esp, 0xc
jmp 0x402a3f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x402a3f
cmp ebp, 0xffffffff
je 0x402a3f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40f1a4]
push dword [esi]
call fcn.004062a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4065ba
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004023c3
xor ebx, ebx
cmp dword [0x410a94], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x406690
push 0x40ca18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x406770
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40ca0c
push edi
call esi
cmp eax, ebx
je 0x406770
push eax
call fcn.00402355
mov dword [esp], 0x40c9fc
push edi
mov dword [0x410a94], eax
call esi
push eax
call fcn.00402355
mov dword [esp], 0x40c9e8
push edi
mov dword [0x410a98], eax
call esi
push eax
call fcn.00402355
mov dword [0x410a9c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401791
test eax, eax
pop ecx
pop ecx
je 0x40665e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040214a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x406690
push 0x40c9cc
push edi
call esi
push eax
call fcn.00402355
cmp eax, ebx
pop ecx
mov dword [0x410aa4], eax
je 0x406690
push 0x40c9b4
push edi
call esi
push eax
call fcn.00402355
pop ecx
mov dword [0x410aa0], eax
mov eax, dword [0x410aa0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x406715
cmp dword [0x410aa4], ecx
je 0x406715
push eax
call fcn.004023cc
push dword [0x410aa4]
mov esi, eax
call fcn.004023cc
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x406715
cmp edi, ebx
je 0x406715
call esi
cmp eax, ebx
je 0x4066e2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4066e2
test byte [ebp - 0x18], 1
jne 0x406715
lea eax, [ebp - 0x10]
push eax
call fcn.004017c8
test eax, eax
pop ecx
je 0x4066fd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040214a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40670c
or dword [ebp + 0x10], 0x200000
jmp 0x406750
or dword [ebp + 0x10], 0x40000
jmp 0x406750
mov eax, dword [0x410a98]
cmp eax, dword [ebp - 8]
je 0x406750
push eax
call fcn.004023cc
cmp eax, ebx
pop ecx
je 0x406750
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x406750
mov eax, dword [0x410a9c]
cmp eax, dword [ebp - 8]
je 0x406750
push eax
call fcn.004023cc
cmp eax, ebx
pop ecx
je 0x406750
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410a94]
call fcn.004023cc
cmp eax, ebx
pop ecx
je 0x406770
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406772
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401005
Capabilities:
Hide graphical window

Disassembly:
jmp 0x403840
sub esp, 8
mov eax, dword [0x41fdc8]
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push ebx
push ebp
push esi
push edi
push eax
push ecx
call fcn.0040103c
mov edx, dword [0x41fdc8]
mov edi, eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
add edi, 0x1d195540
call fcn.0040103c
mov ecx, dword [0x41fdc8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov ebx, eax
push ecx
push edx
add ebx, 0x1d19557c
call fcn.0040103c
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov ebp, eax
mov eax, dword [0x41fdc8]
add ebp, 0x1d19551c
push eax
push ecx
call fcn.0040103c
mov edx, dword [0x41fdc8]
add eax, 0x1d195520
mov dword [esp + 0x30], eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
call fcn.0040103c
mov ecx, dword [0x41fdc8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
add eax, 0x1d195524
push ecx
push edx
mov dword [esp + 0x44], eax
call fcn.0040103c
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
add eax, 0x1d195528
add esp, 0x30
mov ecx, dword [edi + esi]
mov dword [esp + 0x1c], 0
add ecx, ebx
mov ecx, dword [ecx + esi]
add ecx, esi
mov edi, dword [ecx + edx]
mov edx, dword [esp + 0x14]
mov ebx, dword [ecx + eax]
mov ebp, dword [ecx + ebp]
mov edx, dword [ecx + edx]
add edi, esi
add edx, esi
add ebx, esi
test ebp, ebp
jbe 0x403957
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x41fdc8]
push ecx
mov eax, dword [eax]
add eax, esi
push eax
call fcn.0040103c
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ecx
je 0x403957
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jb 0x40391f
cmp dword [esp + 0x1c], ebp
jne 0x403967
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dx, word [ebx + eax*2]
mov eax, dword [edi + edx*4]
pop edi
add eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401019
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
jmp 0x4039f0
sub esp, 8
mov eax, dword [0x41fdd4]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00407d1b
mov ecx, dword [0x41fdd0]
mov edi, eax
push ecx
mov dword [esp + 0x1c], edi
call fcn.00407d1b
mov ecx, eax
mov eax, dword [0x41fdd8]
add esp, 8
xor ebp, ebp
xor ebx, ebx
test eax, eax
jbe 0x403a54
mov eax, ecx
sub eax, edi
mov dword [esp + 0x10], eax
jmp 0x403a34
mov eax, dword [esp + 0x10]
lea esi, [ebx + edi]
mov byte [eax + esi], bl
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ebx
mov dl, byte [edx + eax]
mov byte [esi], dl
mov eax, dword [0x41fdd8]
cmp ebx, eax
jb 0x403a30
mov eax, dword [0x41fddc]
xor esi, esi
test eax, eax
jbe 0x403aa1
mov eax, dword [esp + 0x14]
mov edi, ecx
sub eax, ecx
mov dword [esp + 0x28], eax
jmp 0x403a71
mov eax, dword [esp + 0x28]
mov bl, byte [edi]
xor edx, edx
mov dl, byte [eax + edi]
mov eax, ebx
and eax, 0xff
add ebp, edx
add eax, ebp
xor edx, edx
div dword [0x41fde0]
inc esi
inc edi
mov ebp, edx
mov al, byte [ecx + ebp]
mov byte [ecx + ebp], bl
mov byte [edi - 1], al
mov eax, dword [0x41fddc]
cmp esi, eax
jb 0x403a6d
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jle 0x403b16
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
sub ebp, ebx
mov dword [esp + 0x28], eax
lea eax, [esi + 1]
xor edx, edx
div dword [0x41fde4]
xor eax, eax
mov esi, edx
xor edx, edx
mov al, byte [esi + ecx]
add eax, edi
div dword [0x41fde8]
mov edi, edx
mov dl, byte [esi + ecx]
mov al, byte [edi + ecx]
mov byte [edi + ecx], dl
mov byte [esp + 0x24], al
mov byte [esi + ecx], al
mov edx, dword [esp + 0x24]
xor eax, eax
mov al, byte [edi + ecx]
and edx, 0xff
add eax, edx
xor edx, edx
div dword [0x41fdec]
mov al, byte [edx + ecx]
mov dl, byte [ebx + ebp]
xor al, dl
mov byte [ebx], al
mov eax, dword [esp + 0x28]
inc ebx
dec eax
mov dword [esp + 0x28], eax
jne 0x403ab9
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401041
Capabilities:
Terminate process

Disassembly:
jmp 0x403d40
sub esp, 0x5c
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00401055
test eax, eax
jne 0x403d69
push 0xfff43714
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1cf24
mov dword [0x41fdd0], eax
mov dword [0x41fdd4], eax
mov dword [0x41fdd8], eax
mov dword [0x41fddc], eax
mov dword [0x41fde0], eax
mov dword [0x41fde4], eax
mov dword [0x41fde8], eax
mov dword [0x41fdec], eax
push ebx
push esi
push edi
mov ecx, 0x15
mov esi, str.JeSPcCsCqEip_RduQx9yYZwy7r3cT3YUZjxa71aS6YkxeD8M_VtbyH4ONwQ5vjFXc2pb1k_WLmpi
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
call fcn.0040100a
test eax, eax
je 0x403ecf
lea eax, [esp + 0xc]
push eax
push 0x2096
call fcn.00401037
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403ecf
mov ecx, dword [0x41fdc8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push ecx
push edx
call fcn.0040103c
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov esi, eax
mov eax, dword [0x41fdc8]
add esi, 0x1d195544
push eax
push ecx
call fcn.0040103c
mov edx, dword [0x41fdc8]
mov edi, eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
add edi, 0x1d197504
call fcn.0040103c
add esp, 0x18
add eax, 0x1d196504
or eax, edi
lea ecx, [esp + 0xc]
push esi
push eax
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push 0xffffffffffffffff
call dword [0x4222fc]
test eax, eax
jl 0x403e57
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push 0x54
push ecx
push edx
push ebx
call fcn.00401019
add esp, 0x14
call dword [esp + 0x10]
mov esi, dword [esp + 0x74]
push esi
call fcn.00414d30
push str.reglagesepare
push esi
call fcn.00407db0
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov dword [0x422554], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0xb4aeb5
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x422528], eax
push 0x6e
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x422540]
push 0
push 0x401050
push 0
push 0x65
push ecx
mov dword [0x422384], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push str.OK_GOOGLE___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x5c
ret 0x10

Function at 0x40104b
Capabilities:
Print debug messages

Disassembly:
jmp 0x4010b0
mov ecx, dword [esp + 4]
sub esp, 0x400
lea eax, [esp + 0x408]
lea edx, [esp]
push ebx
push esi
push edi
push eax
push ecx
push edx
call fcn.00407641
mov edi, 0x41fe80
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
add esp, 0x400
ret
Function at 0x40d4dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x420de0
cmp edx, dword [eax]
je 0x40d4ff
add eax, 8
inc ecx
cmp eax, 0x420e70
jl 0x40d4f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x420de0]
jne 0x40d62d
mov eax, dword [0x422b2c]
cmp eax, 1
je 0x40d607
test eax, eax
jne 0x40d530
cmp dword [0x4204a4], 1
je 0x40d607
cmp edx, 0xfc
je 0x40d62d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d567
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e580
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408ec0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40d5aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408ec0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41c79c
push edi
call fcn.0040f310
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e580
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e590
lea eax, [ebp - 0xa0]
push 0x41c77c
push eax
call fcn.0040e590
push dword [esi + 0x420de4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e590
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00410e01
add esp, 0x2c
pop edi
jmp 0x40d62d
lea eax, [ebp + 8]
lea esi, [esi + 0x420de4]
push 0
push eax
push dword [esi]
call fcn.00408ec0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x43a0d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b3b0]
jne 0x43a0da
repz ret
jmp fcn.00444150
Function at 0x453450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
cmp dword [0x789ee8], 0x37
jne 0x45351c
push 0
push 0x42bb88
push 0
push 0x42bb98
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x42bba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push 0x42bbd8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x528]
push ecx
push 0x42bc00
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x928]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
push 0x42bc24
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0x42bc54
push 0
push 0x42bc64
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov edx, dword [0x781934]
add edx, dword [ebp + 8]
mov eax, dword [0x789eec]
add eax, dword [ebp + 8]
mov cl, byte [eax + 0x12336]
mov byte [edx], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x453980
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c0
call fcn.00445e80
mov dword [ebp - 4], 0
jmp 0x45399f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x453a30
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x789ee8], 0x9e
jne 0x453a20
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x42bc88
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0x42bd80
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea edx, [ebp - 0x4a0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
cmp dword [ebp - 4], 0x9be51dc
jle 0x453a2b
jmp 0x453a30
jmp 0x453996
push 0x45c400
mov eax, dword [0x789ee8]
push eax
mov ecx, dword [0x781934]
push ecx
call fcn.00453900
mov dword [ebp - 0x4a4], 0
jmp 0x453a62
mov edx, dword [ebp - 0x4a4]
add edx, 1
mov dword [ebp - 0x4a4], edx
cmp dword [ebp - 0x4a4], 0x3e79e
jge 0x453a81
cmp dword [ebp - 0x4a4], 0x1e673
jne 0x453a7f
call fcn.00453430
jmp 0x453a53
mov dword [ebp - 0x4a8], 0
jmp 0x453a9c
mov eax, dword [ebp - 0x4a8]
add eax, 1
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xdd9a7
jge 0x453ad2
cmp dword [0x789ee8], 0xc01
jne 0x453ad0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0x42bd5c
push 0x42bdc8
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
jmp 0x453a8d
jmp dword [0x781934]
Function at 0x4227e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x422805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x422878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x42283a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x42286d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x42286b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x422831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4227fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x910c22
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x908571]
jne 0x910c2c
repz ret
jmp fcn.00913e72

Function at 0x9143fc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0090e94a
xor ebx, ebx
cmp dword [0x90b11d], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x9144d1
push 0x90a239
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x91443c
xor eax, eax
jmp 0x914595
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x90a22d
push edi
call esi
cmp eax, ebx
je 0x914435
push eax
call fcn.0090e8e7
mov dword [esp], 0x90a21d
push edi
mov dword [0x90b11d], eax
call esi
push eax
call fcn.0090e8e7
mov dword [esp], 0x90a209
push edi
mov dword [0x90b121], eax
call esi
push eax
call fcn.0090e8e7
mov dword [0x90b125], eax
lea eax, [ebp - 8]
push eax
call fcn.0090e6a8
test eax, eax
pop ecx
pop ecx
je 0x91449f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0090e26e
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x9144d1
push 0x90a1ed
push edi
call esi
push eax
call fcn.0090e8e7
cmp eax, ebx
pop ecx
mov dword [0x90b12d], eax
je 0x9144d1
push 0x90a1d5
push edi
call esi
push eax
call fcn.0090e8e7
pop ecx
mov dword [0x90b129], eax
mov eax, dword [0x90b129]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x91454a
cmp dword [0x90b12d], esi
je 0x91454a
push eax
call fcn.0090e953
pop ecx
call eax
cmp eax, ebx
je 0x914517
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x90b12d]
call fcn.0090e953
pop ecx
call eax
test eax, eax
je 0x914517
test byte [ebp - 0x18], 1
jne 0x91454a
lea eax, [ebp - 0xc]
push eax
call fcn.0090e6df
test eax, eax
pop ecx
je 0x914532
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0090e26e
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x914541
or dword [ebp + 0x10], 0x200000
jmp 0x91457b
or dword [ebp + 0x10], 0x40000
jmp 0x91457b
mov eax, dword [0x90b121]
cmp eax, esi
je 0x91457b
push eax
call fcn.0090e953
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x91457b
mov eax, dword [0x90b125]
cmp eax, esi
je 0x91457b
push dword [ebp - 4]
push eax
call fcn.0090e953
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x90b11d]
call fcn.0090e953
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb312b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0xb350a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.00b311ad
test eax, eax
jne 0xb31323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xb31340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0xb31323
cmp dword [ebp - 0x10], 4
jne 0xb31323
cmp dword [ebp - 8], 1
jne 0xb31323
cmp dword [esi + 0xc], ebx
je 0xb3136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0xb3133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0xb31323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0xb31323