joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101462d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1019bbbc], 0
mov dword [0x1019bbc0], 0
mov dword [0x1019bbcc], 0
mov ebx, dword [0x1019bbb4]
add ebx, 0xffffec41
mov dword [0x1019bbb8], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x1014634d
mov dword [0x1019bbb8], 0x22fd
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add edx, 1
mov edi, ecx
add edi, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1019bbbc], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019bbc0], edx
mov dword [0x1019bbb8], 0x63e
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1019bbc4], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1019bbc4]
mov edx, dword [0x1019bbc0]
mov byte [ebx + edx], cl
mov edx, dword [0x1019bbbc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1019bbc0]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1019bbcc], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x1019bbb8], 0xff5
mov dword [0x1019bbb4], 0xc9e
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1014633b
mov eax, dword [0x1019bbc0]
mov ecx, dword [0x1019bbbc]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1014634d
Function at 0x10146439
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x1019bbb4]
mov esi, edx
add esi, 0xffffddef
mov dword [0x1019bbb8], esi
add edx, 0xfffff1ae
mov dword [0x1019bbb4], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10145c33
lea ecx, [0x10145153]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x84], 0x137a00
mov edx, dword [0x1019bba0]
mov dword [esp + 0x30], edx
mov edx, dword [0x1019bba4]
mov dword [esp + 0x54], edx
mov dword [0x1019bbb4], 0x1a6c
mov edx, dword [0x1019bba8]
mov dword [esp + 0x34], edx
mov edx, dword [0x1019bbac]
mov dword [esp + 0x58], edx
mov edx, dword [0x1019bbb0]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1019bbb8]
add edx, 0xc86
mov dword [0x1019bbb8], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10146521
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1014557e
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1019bbb8], 0xd4a
mov dword [esp + 0x10], eax
jmp 0x10146596
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x10146544
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x10146558
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10146521
mov eax, dword [esp + 0xc]
mov dword [esp + 0x70], eax
mov dword [0x1019bbb8], 0x8e8
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x38], edx
mov dword [0x1019bbb4], 0x1277
call fcn.101459ed
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x101464eb
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00406dc2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00406dc2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00406dc2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00406dc2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00406dc2
mov dword [0x41203c], eax
call fcn.00406dc2
test eax, eax
jge 0x402550
push 8
call fcn.00406dc2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00406dc2
pop ecx
push 1
call fcn.00406dc2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00406dc2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00406dc2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00406dc2
jmp 0x402495

Function at 0x406dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406dd1
pop dword [ebp - 0x2c]
mov eax, 0xd0502803
sub eax, 0xd00fba32
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x360f9
push 0
mov eax, 0x8e7c755c
sub eax, 0x8e3b9484
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xa83e817b
add ecx, 0x57c1b995
mov edx, eax
mov ebx, 0x764b0e97
sub ebx, 0x7609d2d3
add ebx, dword [ebp - 0x2c]
mov edi, 0x60d20182
add edi, 0xb77595f6
xor dword [ebp - 0x28], 0xe36b982b
mov esi, dword [ebx]
add dword [ebp - 0x24], ecx
sub esi, edi
mov dword [edx], esi
sub dword [ebp - 0x10], 0x70f98bdb
add edx, 4
add ebx, 0xd90b79df
add ebx, 0x26f48625
loop 0x406e30
add eax, 0x37f72a9e
add eax, 0xc809b475
mov ebx, eax
add eax, 0x8ef63ab3
add eax, 0x7109c552
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401050
Capabilities:
Create thread
Execute command

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401080
push 0x64
call esi
jmp 0x401030
push str.title_PlaySound_Demo
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x401020
Function at 0x402bec
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x208
push eax
push 0
push 0x40142c
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x402c4b
mov eax, dword [ebp - 4]
cmp eax, 2
jb 0x402c46
shr eax, 1
xor ecx, ecx
cmp cx, word [esi + eax*2 - 2]
jne 0x402c46
mov eax, dword [ebp - 8]
sub eax, 1
je 0x402c42
sub eax, 1
jne 0x402c46
mov ecx, esi
call fcn.00402a7e
jmp 0x402c4b
xor eax, eax
jmp 0x402c4b
mov eax, 0x3f7
pop esi
leave
ret 8

Function at 0x403040
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4036d8
call fcn.0040345c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4043d0
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x402e5e
cmp eax, esi
jne 0x402e51
xor esi, esi
inc esi
mov edi, esi
jmp 0x402e61
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x402e35
xor esi, esi
inc esi
cmp dword [0x4043d4], esi
jne 0x402e73
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x402ead
cmp dword [0x4043d4], ebx
jne 0x402ea7
mov dword [0x4043d4], esi
push 0x4011bc
push 0x4011b0
call fcn.00495000
pop ecx
pop ecx
test eax, eax
je 0x402ead
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402f82
mov dword [0x404044], esi
cmp dword [0x4043d4], esi
jne 0x402ed0
push 0x4011ac
push 0x4011a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4043d4], 2
test edi, edi
jne 0x402edd
xor eax, eax
mov ecx, 0x4043d0
xchg dword [ecx], eax
cmp dword [0x4043d8], 0
je 0x402f09
push 0x4043d8
call fcn.00403290
pop ecx
test eax, eax
je 0x402f09
push ebx
push 2
push ebx
mov esi, dword [0x4043d8]
mov ecx, esi
call dword [0x405168]
call esi
push dword [0x404050]
push dword [0x40404c]
push dword [0x404048]
call fcn.00401ba7
add esp, 0xc
mov dword [0x404040], eax
cmp dword [0x404058], 0
jne 0x402f67
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404044], 0
jne 0x402f7b
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404040]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00403399
jmp 0x402e19
Function at 0x40102b
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 0x413b90
jmp 0x40102a
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 0xa0
lea edi, [esi + 0xc]
push ebx
push edi
mov dword [esi], 0x40e210
call fcn.00406360
add esp, 0xc
mov dword [edi], 0xa0
mov dword [esi + 8], ebx
mov dword [esi + 0xb0], ebx
push str.rasapi32
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0xac], eax
je 0x401185
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.RasEnumDevicesA
push eax
call edi
push str.RasEnumEntriesA
mov dword [esi + 0xbc], eax
push dword [esi + 0xac]
call edi
push str.RasSetEntryPropertiesA
mov dword [esi + 0xc0], eax
push dword [esi + 0xac]
call edi
push str.RasGetEntryPropertiesA
mov dword [esi + 0xc4], eax
push dword [esi + 0xac]
call edi
push str.RasDeleteEntryA
mov dword [esi + 0xdc], eax
push dword [esi + 0xac]
call edi
push str.RasDialA
mov dword [esi + 0xcc], eax
push dword [esi + 0xac]
call edi
push str.RasHangUpA
mov dword [esi + 0xb8], eax
push dword [esi + 0xac]
call edi
push str.RasGetErrorStringA
mov dword [esi + 0xd0], eax
push dword [esi + 0xac]
call edi
push str.RasEnumConnectionsA
mov dword [esi + 0xc8], eax
push dword [esi + 0xac]
call edi
push str.RasGetConnectStatusA
mov dword [esi + 0xd4], eax
push dword [esi + 0xac]
call edi
cmp dword [esi + 0xbc], ebx
mov dword [esi + 0xd8], eax
je 0x401182
cmp dword [esi + 0xc0], ebx
je 0x401182
cmp dword [esi + 0xc4], ebx
je 0x401182
cmp dword [esi + 0xdc], ebx
je 0x401182
cmp dword [esi + 0xcc], ebx
je 0x401182
cmp dword [esi + 0xb8], ebx
je 0x401182
cmp dword [esi + 0xd0], ebx
je 0x401182
cmp dword [esi + 0xc8], ebx
je 0x401182
cmp dword [esi + 0xd4], ebx
je 0x401182
cmp eax, ebx
je 0x401182
push 1
pop ebx
mov dword [esi + 4], ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x4024a1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, ecx
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
call fcn.004064d0
pop ecx
mov dword [esi + 0x14], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push ecx
push eax
push 0xf003f
push 1
push eax
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4024f5
xor al, al
jmp 0x40263f
xor eax, eax
push ebx
lea ecx, [esi + 0x10]
push eax
lea edi, [esi + 0xc]
push eax
lea ebx, [esi + 8]
push ecx
push edi
push ebx
lea ecx, [esi + 4]
push eax
push ecx
push esi
push eax
push eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x402633
mov eax, dword [ebx]
test eax, eax
je 0x402633
imul eax, eax, 0x4f4
push eax
call fcn.004064d0
inc dword [edi]
and dword [ebp - 0x18], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x10]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.004064d0
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004064d0
mov dword [ebp - 0x10], eax
xor eax, eax
add esp, 0xc
cmp dword [ebx], eax
mov dword [ebp - 4], eax
jbe 0x402621
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x402604
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 8]
inc eax
push eax
mov eax, ebx
push dword [ebp - 0xc]
add eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + eax + 0x100], ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebx + eax + 0x104], ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ebx + eax + 0x4f0], ecx
xor eax, eax
cmp dword [ebp + 8], eax
jbe 0x402609
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov edx, dword [esi + 0x1c]
add ecx, eax
mov bl, byte [eax + ebx]
inc eax
mov byte [ecx + edx + 0x108], bl
cmp eax, dword [ebp + 8]
jb 0x4025e7
jmp 0x402609
mov eax, dword [ebp - 4]
mov dword [ebx], eax
inc dword [ebp - 4]
add dword [ebp - 8], 0x4f4
mov eax, dword [ebp - 4]
lea ebx, [esi + 8]
cmp eax, dword [ebx]
jb 0x402573
push dword [ebp - 0xc]
call fcn.004063b8
push dword [ebp - 0x10]
call fcn.004063b8
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4036ec
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
push esi
push edi
push 0x65
push eax
mov dword [0x413c78], eax
mov dword [0x413c80], ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
mov edi, 0x101
push edi
push 0x413d88
push 2
mov dword [0x413c7c], eax
push dword [0x413c78]
call esi
push edi
push 0x413c84
push 1
push dword [0x413c78]
call esi
push 0x4101ec
push 0x402fde
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 1
call fcn.004030d2
pop ecx
pop ecx
mov ecx, 0x4145c0
call fcn.00403924
pop edi
pop esi
ret 0x10
Function at 0x403ebd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
cmp word [ebp + 8], bx
jne 0x403f95
mov edi, 0x413b90
mov ecx, edi
call fcn.0040208c
test eax, eax
jne 0x403f15
cmp dword [esi + 4], eax
jne 0x403f15
push str.Beliavskiy
push 0x402fde
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, esi
call fcn.004051fb
test eax, eax
je 0x4040aa
mov ecx, esi
call fcn.00404fb5
jmp 0x4040aa
push 0x124
push str.Disconnect
push str.Disconnect__
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4040aa
push 0
push ebx
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push str.Disconnecting...
mov ecx, esi
call fcn.00404f68
push 0xa
mov ecx, esi
call fcn.00405122
push 0
mov ecx, edi
call fcn.00401ffd
and dword [esi + 4], 0
push 0x3b
push dword [esi + 0x64]
lea eax, [ebp - 0x34]
push str.Connect_Verbinden_Conectar_
push eax
call fcn.00402ac9
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
push ebx
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x4040aa
cmp word [ebp + 8], 0x3e8
jne 0x404066
mov eax, dword [ebp + 8]
shr eax, 0x10
cmp ax, bx
jne 0x4040aa
mov eax, dword [esi + 0x70]
cmp eax, 0xffffffff
je 0x4040aa
imul eax, eax, 0x798
mov ecx, dword [0x413c44]
push 0x31
lea eax, [eax + ecx + 0x691]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea eax, [ebp - 0x68]
push eax
push 0x3ef
push dword [esi + 0x4c]
call ebx
mov eax, dword [esi + 0x70]
push 0x4101bc
imul eax, eax, 0x798
add eax, dword [0x413c44]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x404016
push str.Hilfe
jmp 0x404043
mov al, byte [0x413c70]
push 0xc
mov byte [ebp - 0x34], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
push 0x3b
push dword [esi + 0x64]
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
push str.Log_Protokoll_Protocolo_
push eax
call fcn.00402ac9
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
push 0x406
push dword [esi + 0x4c]
call ebx
push 0
push 0
push 0x8069
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.00405a95
cmp word [ebp + 8], 0x406
jne 0x4040aa
mov eax, dword [esi + 0x70]
push 0x4101bc
imul eax, eax, 0x798
add eax, dword [0x413c44]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4040a3
push eax
push str.Hilfe
push str.1._Programm_deinstallieren:_n_____Klicken_Sie__Start____Einstellungen___Systemsteuerung___Software___n_____W
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4040aa
mov ecx, esi
call fcn.00405afa
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4042cd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x81
push dword [esi + 0x90]
push 0x3ed
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
push 0x7e
lea eax, [eax + ecx + 0x185]
push eax
call fcn.00402aa0
pop ecx
test eax, eax
pop ecx
jle 0x404359
mov eax, dword [esi + 0x6c]
cmp eax, 1
je 0x40432c
cmp eax, 3
je 0x40432c
xor eax, eax
jmp 0x40432f
push 1
pop eax
push 0x7e
push eax
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
lea eax, [eax + ecx + 0x185]
push eax
push dword [esi + 0x94]
call fcn.00402ac9
add esp, 0x10
jmp 0x40437c
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
lea eax, [eax + ecx + 0x185]
push eax
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push dword [esi + 0x94]
push 0x3ee
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
push dword [esi + 0x90]
lea eax, [eax + ecx + 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, dword [esi + 0x70]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
imul eax, eax, 0x798
add eax, dword [0x413c44]
push 0x4101bc
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
test eax, eax
jne 0x404419
push 6
lea eax, [ebp - 8]
push dword [esi + 0x94]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea eax, [ebp - 8]
push str.01033
push eax
call edi
test eax, eax
je 0x404419
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
push str.0_1033
lea eax, [eax + ecx + 0x104]
push eax
call ebx
mov eax, dword [esi + 0x70]
mov ecx, dword [0x413c44]
imul eax, eax, 0x798
push dword [esi + 0x94]
lea eax, [eax + ecx + 0x104]
push eax
call ebx
mov al, byte [0x413c70]
lea edi, [ebp - 1]
mov byte [ebp - 2], al
xor eax, eax
stosb byte es:[edi], al
lea eax, [ebp - 2]
push 0xa
push eax
mov eax, dword [esi + 0x6c]
inc eax
push eax
call fcn.0040699f
add esp, 0xc
add esi, 0x8c
push str.Attempt
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 2]
push eax
push dword [esi]
call ebx
push 0x41012c
push dword [esi]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405afa
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
push 0
push 0
push 0x413fa0
push str.open
mov esi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x405b32
push 0xfffffffffffffff6
push dword [esi + 0x4c]
call fcn.00402d16
pop ecx
pop ecx
push 0
mov ecx, 0x413b90
call fcn.00401ffd
pop esi
ret

Function at 0x405b34
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push ebx
and eax, 0xfff0
mov ebx, ecx
cmp eax, 0xf060
jne 0x405b94
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0x3ed
push dword [esp + 0x14]
call esi
mov edi, dword [sym.imp.USER32.dll_IsWindowEnabled]
push eax
call edi
test eax, eax
jne 0x405b81
push 1
push dword [esp + 0x14]
call esi
push eax
call edi
test eax, eax
je 0x405b81
push 1
mov ecx, ebx
call fcn.004040b1
jmp 0x405b8d
push 0
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
pop eax
pop edi
pop esi
jmp 0x405b96
xor eax, eax
pop ebx
ret 0xc

Function at 0x405b9b
Capabilities:
Access peb ldr_data
Get ntdll base address
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e220
push 0x406e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
mov dword [esi], 0x40e218
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
push 0x823
call fcn.004064d0
mov dword [ebp - 0x1c], eax
mov dword [esi + 0x18], eax
push 0xff
call fcn.004064d0
mov dword [ebp - 0x20], eax
mov dword [esi + 0x1c], eax
push 0x7ff
call fcn.004064d0
add esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esi + 0x20], eax
push str.wininet
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x405ce4
push str.InternetOpenA
push eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call edi
mov dword [esi + 0x2c], eax
push str.InternetConnectA
push dword [esi + 8]
call edi
mov dword [esi + 0x30], eax
push str.HttpOpenRequestA
push dword [esi + 8]
call edi
mov dword [esi + 0x38], eax
push str.HttpSendRequestA
push dword [esi + 8]
call edi
mov dword [esi + 0x3c], eax
push str.InternetCloseHandle
push dword [esi + 8]
call edi
mov dword [esi + 0x34], eax
push str.HttpQueryInfoA
push dword [esi + 8]
call edi
mov dword [esi + 0x40], eax
push str.InternetReadFile
push dword [esi + 8]
call edi
mov dword [esi + 0x44], eax
cmp dword [esi + 0x2c], ebx
je 0x405cbf
cmp dword [esi + 0x30], ebx
je 0x405cbf
cmp dword [esi + 0x38], ebx
je 0x405cbf
cmp dword [esi + 0x3c], ebx
je 0x405cbf
cmp dword [esi + 0x34], ebx
je 0x405cbf
cmp dword [esi + 0x40], ebx
je 0x405cbf
cmp eax, ebx
je 0x405cbf
push 1
pop ebx
mov dword [esi + 4], ebx
jmp 0x405ce4
or dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret