joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1024886
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1028370], 0xffffffff
jne 0x10248f8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10028c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10248f8
and dword [0x1028370], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x10028a4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10248ef
mov eax, 0x600
cmp word [ebp - 0xc], ax
sbb eax, eax
inc eax
mov dword [0x1028370], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1028370]
leave
ret

Function at 0x1024973
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x1002840
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024a0d
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x1002888
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024a01
test esi, esi
je 0x1024a01
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.01024904
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x20c], ax
pop esi
setne al
xor ecx, ebp
call fcn.01023d2d
leave
ret 8

Function at 0x1024a2d
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.01024973
test eax, eax
je 0x1024b12
lea eax, [ebp - 0x20c]
push eax
call fcn.01024731
test eax, eax
je 0x1024b12
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024973
test eax, eax
je 0x1024b12
push ebx
push 0x1002818
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024bf5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x418], eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push 0x1001420
push dword [ebp - 0x41c]
push 0x1002830
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x418], 0xffffffff
je 0x1024b11
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 4
Function at 0x401050
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x214]
push ebx
sub esp, 0x21c
mov dword [ebp - 0x218], eax
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
sub esp, 8
test eax, eax
je 0x40111a
mov dword [esp], 0xc
mov edi, dword [sym.imp.ucrtbase.dll_malloc]
call edi
mov ebx, eax
test eax, eax
je 0x40111a
mov dword [esp], 0x230
call edi
mov dword [ebx + 8], eax
mov edx, eax
test eax, eax
je 0x401153
mov edi, dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x4010de
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x401130
mov edx, dword [ebx + 8]
mov eax, dword [section..bss]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x40c000
add eax, 1
mov dword [esp], esi
mov dword [section..bss], eax
mov dword [esp + 8], eax
call edi
sub esp, 0x10
test eax, eax
jne 0x4010c0
mov eax, dword [ebx + 8]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x218]
lea eax, [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov edx, dword [ebx + 8]
mov dword [ecx + 0xc], ebx
lea esp, [ebp - 0xc]
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x218], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x218]
jmp 0x40111c
Function at 0x4012b0
Capabilities:
Extract cabinet on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x18]
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x401170
mov dword [esp + 0x14], 0x401000
mov dword [esp + 0x10], 0x4011a0
mov dword [esp + 0xc], 0x4011e0
mov dword [esp + 8], 0x401220
mov dword [esp + 4], 0x401030
mov dword [esp], 0x401040
call sub.cabinet.dll_FDICreate
test eax, eax
je 0x401410
mov ebx, eax
test esi, esi
je 0x401420
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [ebp - 0x24], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401420
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x4020a0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.cabinet.dll_FDICopy
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call sub.cabinet.dll_FDIDestroy
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x4013f6
Function at 0x401b40
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x254]
lea esi, [ebp - 0x258]
push ebx
mov edi, edx
lea ebx, [ebp - 0x214]
sub esp, 0x28c
mov dword [ebp - 0x270], 1
rep stosd dword es:[edi], eax
mov dword [esp], ebx
mov dword [ebp - 0x258], 0x44
mov dword [esp + 4], 0x104
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
mov dword [esp + 4], str.wusa.exe
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
lea eax, [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea edx, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x401c90
test byte [section..data], 8
jne 0x401cda
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0x270]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x268]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
push edx
push edx
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x264]
push ecx
mov dword [esp], eax
call ebx
push ebx
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
mov eax, dword [ebp - 0x270]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
test byte [section..data], 2
je 0x401c6f
mov eax, dword fs:[0x18]
or edx, 0xffffffff
mov esi, dword [eax + 0x34]
mov eax, ebx
call fcn.00401930
mov dword [esp + 0xc], str.Failed_to_restart_64_bit__s__err__lu_n
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_as_x86_64
mov dword [esp + 4], 0x40a000
mov dword [esp], 1
call fcn.00401af0
jmp 0x401c6f
or edx, 0xffffffff
mov eax, ebx
call fcn.00401930
mov dword [esp + 0xc], str.Restarting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_as_x86_64
mov dword [esp + 4], 0x40a000
mov dword [esp], 3
call fcn.00401af0
jmp 0x401c1d

Function at 0x401d20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401d50
test al, 0x10
je 0x401d50
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x401d3e
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
mov ebx, dword [ebp - 4]
leave
sete al
movzx eax, al
ret
Function at 0x401d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
test eax, eax
je 0x401e34
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.shlwapi.dll_PathRemoveFileSpecW]
sub esp, 4
test eax, eax
jne 0x401dc0
xor ebx, ebx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401dda
mov ebx, 1
test al, 0x10
jne 0x401dad
movzx eax, word [esi]
mov ebx, esi
test ax, ax
jne 0x401dfc
jmp 0x401e26
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401e26
cmp ax, 0x5c
jne 0x401df0
xor edx, edx
mov eax, esi
mov word [ebx], dx
call fcn.00401d20
test eax, eax
je 0x401dab
mov eax, 0x5c
add ebx, 2
mov word [ebx - 2], ax
movzx eax, word [ebx]
test ax, ax
jne 0x401dfc
mov eax, esi
call fcn.00401d20
mov ebx, eax
jmp 0x401dad
xor ebx, ebx
jmp 0x401db6

Function at 0x401f70
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test eax, eax
je 0x402090
push ebp
mov edx, 0x40c06e
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x260
call fcn.00401e40
mov edi, eax
test eax, eax
je 0x40205f
lea eax, [ebp - 0x25c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
sub esp, 8
mov dword [esp], edi
mov dword [ebp - 0x260], eax
call eax
cmp esi, 0xffffffff
je 0x402053
lea edi, [ebp - 0x230]
mov dword [esp + 4], 0x40c072
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40202d
mov dword [esp + 4], 0x40c076
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40202d
mov edx, edi
mov eax, ebx
call fcn.00401e40
test eax, eax
je 0x40202d
test byte [ebp - 0x25c], 0x10
je 0x402070
mov dword [ebp - 0x264], eax
call fcn.00401f70
mov edx, dword [ebp - 0x264]
mov dword [esp], edx
mov eax, dword [ebp - 0x260]
call eax
lea eax, [ebp - 0x25c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401fd1
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
mov dword [ebp - 0x264], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov edx, dword [ebp - 0x264]
sub esp, 4
jmp 0x402022
ret
Function at 0x402990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
call fcn.004027b0
mov ecx, dword [edi + 0x10]
mov ebx, eax
test ecx, ecx
je 0x4029f8
test eax, eax
je 0x402ab0
cmp word [ebx], 0
mov eax, ebx
je 0x402ac0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4029c8
sub eax, ebx
add eax, 2
mov edx, dword [ebp + 8]
test edx, edx
je 0x402a05
mov esi, 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
jne 0x4029b9
mov edx, dword [ebp + 8]
xor eax, eax
test edx, edx
jne 0x4029dd
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x4029dd
xor esi, esi
test byte [section..data], 2
je 0x4029e2
mov esi, dword [edi + 8]
test esi, esi
je 0x402adf
mov eax, esi
shr eax, 0x10
je 0x402aca
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40c015
test edx, edx
jne 0x402a7b
mov edx, 0xffffffff
mov eax, esi
call fcn.004014c0
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_string
mov dword [esp + 4], 0x40a000
mov dword [esp], 1
call fcn.00401af0
jmp 0x4029e2
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4029d6
movzx esi, si
mov dword [esp], 0x40c008
mov dword [esp + 4], esi
call fcn.004016e0
jmp 0x402a7b
mov eax, 0x40c00e
jmp 0x402a7b
Function at 0x4091f0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x409260
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004062e0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x10045e8
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1004d60
call fcn.01004604
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x100739c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100439f
cmp eax, esi
jne 0x1004392
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10043a2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1004379
xor esi, esi
inc esi
mov eax, dword [0x1007398]
cmp eax, esi
jne 0x10043b5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10043e4
mov eax, dword [0x1007398]
test eax, eax
jne 0x10043de
mov dword [0x1007398], esi
push 0x100124c
push 0x1001240
call fcn.010042de
pop ecx
pop ecx
test eax, eax
je 0x10043e4
jmp 0x100450c
mov dword [0x1007058], esi
mov eax, dword [0x1007398]
cmp eax, esi
jne 0x1004408
push 0x100123c
push 0x1001234
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1007398], 2
test ebx, ebx
jne 0x1004414
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10073a0], 0
je 0x1004438
push 0x10073a0
call fcn.010047d9
pop ecx
test eax, eax
je 0x1004438
push 0
push 2
push 0
call dword [0x10073a0]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1004494
test al, al
je 0x1004452
cmp dword [ebp - 0x1c], 0
jne 0x1004494
mov al, byte [esi]
test al, al
je 0x1004462
cmp al, 0x20
ja 0x1004462
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1004452
test byte [ebp - 0x3c], 1
je 0x100446e
movzx eax, word [ebp - 0x38]
jmp 0x1004471
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1007054], eax
cmp dword [0x1007048], 0
jne 0x10044e8
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10044a3
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10044b6
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100443f
cmp dword [0x1007058], 0
jne 0x10044f7
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1007054]
jmp 0x1004518
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01004649
ret
call fcn.01004926
jmp 0x100433f
Function at 0x409f33
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00409f33
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 1
push 0
push 0
mov edx, 0x40c85c
call fcn.0040aed5
lea ebx, [esp + 0x10]
call fcn.0040aa85
mov edx, 0x40c850
call fcn.0040aed5
lea ebx, [esp + 0x10]
call fcn.0040aa85
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.0040a92a
mov eax, dword [ebx + 4]
call fcn.0040a92a
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a058
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x40a03a], 4
jne 0x40a073
jmp 0x40a4a2
jmp fcn.0040a2a5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0040a1a1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x40a4f3
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0040a247
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.0040a078
push 0xff
jb 0x40a572
pop eax
movzx ecx, word [0x40a038]
jecxz 0x40a53d
push ecx
push 8
push esp
call dword [0x43b000]
pop eax
pop eax
call fcn.0040a0ed
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0040a57e
mov ecx, dword [ebx + 0xb4]
jecxz 0x40a562
push ecx
call dword [0x43b000]
mov edi, dword [ebx + 0x428]
call fcn.0040a0f2
call fcn.0040a0d9
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x40a078
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x40a0d8
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.0040a384
jb 0x40a0d8
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.0040a0c7
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x40a0e1
push ebx
jb 0x40a12e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret
Function at 0x40a2a5
Capabilities:
Terminate process

Disassembly:
mov edx, 0xf4
jmp 0x40a2b1
mov dh, 0xb0
mov word [ebp - 0x90], dx
jmp 0x40a2c7
test byte [ebp - 0x90], 0xff
jne 0x40a2d9
mov word [ebp - 0x90], 0xb033
push eax
push ebx
push ecx
push esi
push edi
mov ax, word [ebp - 0x8e]
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
call fcn.0040a384
jb 0x40a313
test dword [eax + 0x28], 0xffffffff
je 0x40a313
test dword [eax + 0x24], 0xffffffff
je 0x40a313
call fcn.0040a2a5
mov edi, dword [ebp - 0x84]
mov ecx, dword [edi - 6]
jecxz 0x40a346
xor ebx, ebx
mov edx, dword [esp + 0x14]
xor esi, esi
mov bl, byte [ecx]
inc ecx
cmp bl, 0xff
jne 0x40a336
add esi, 0xfe
jmp 0x40a326
add esi, ebx
add edi, esi
cmp edi, edx
jb 0x40a324
mov dword [eax + 0x30], edi
sub edi, esi
mov dword [eax + 0x2c], edi
test word [0x40a03a], 0x2000
je 0x40a367
test dword [ebp - 0x8c], 0xffffffff
jne 0x40a367
call fcn.0040a2a5
cmp eax, 1
jne 0x40a376
cmp byte [ebp - 0x90], 0xf1
jae 0x40a376
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
push 0xff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x40a5e2
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040a8a0
test eax, eax
jns 0x40a5fb
add eax, ecx
test edx, edx
je 0x40a63b
jns 0x40a606
add edx, ecx
js 0x40a63b
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x40a60f
xor ecx, ecx
cmp ecx, eax
jb 0x40a615
mov ecx, eax
call fcn.0040a844
jb 0x40a63f
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a918
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x40a629
pop edi
pop esi
jmp fcn.0040a2bc

Function at 0x40a6d9
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.0040a844
jb 0x40a6fc
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0040aef4
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0040aef2
jmp fcn.0040a2bc

Function at 0x40a73a
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.0040a844
jb 0x40a75a
call fcn.0040aef4
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0040aef2
pop edi
jmp fcn.0040a2bc