joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10034df0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10034d0d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10041090]
jb 0x10034c8a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10041094]
ja 0x10034c8a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10034c5a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10034cb0
jmp 0x10034d0d
cmp dword [ebp - 0x14], 0x10000
jne 0x10034cf3
cmp dword [ebp - 0x18], 0x10000
jb 0x10034cf3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10034ce6
mov eax, dword [ebp - 8]
jmp 0x10034d0f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10034d08
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10034df0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10034c5a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10034d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10034e20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10034de5
mov edx, dword [ebp - 4]
cmp edx, dword [0x10041090]
jb 0x10034d65
mov eax, dword [ebp - 4]
cmp eax, dword [0x10041094]
ja 0x10034d65
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10034d35
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10034d8b
jmp 0x10034de5
cmp dword [ebp - 0x14], 0x10000
jne 0x10034dce
cmp dword [ebp - 0x18], 0x10000
jb 0x10034dce
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10034dc1
mov eax, dword [ebp - 8]
jmp 0x10034de7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10034de0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10034e20
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10034d35
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40191b
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401971
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x40c25c
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x84]
push edx
call fcn.00401000
add esp, 4
jmp 0x401a50
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4019cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
push edx
push 0x40c284
lea eax, [ebp - 0x108]
push eax
call fcn.0040372b
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call fcn.00401000
add esp, 4
jmp 0x401a46
lea edx, [ebp - 0x124]
push edx
push 1
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401a03
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x401a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
push eax
push str.ControlService_failed__error_code___d
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x1a4]
push edx
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401a56
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401aac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x40c2d0
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x84]
push edx
call fcn.00401000
add esp, 4
jmp 0x401b8a
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x401b06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
push edx
push 0x40c2f8
lea eax, [ebp - 0x108]
push eax
call fcn.0040372b
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call fcn.00401000
add esp, 4
jmp 0x401b80
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x401b3d
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x401b8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
push ecx
push str.StartService_failed__error_code___d
lea edx, [ebp - 0x188]
push edx
call fcn.0040372b
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
call fcn.00401000
add esp, 4
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401e27
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x40c42c
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x84]
push edx
call fcn.00401000
add esp, 4
jmp 0x401f4f
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x401ed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
push edx
push str.OpenService_failed__error_code___d
lea eax, [ebp - 0x108]
push eax
call fcn.0040372b
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call fcn.00401000
add esp, 4
jmp 0x401f45
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401f11
mov eax, dword [ebp + 8]
push eax
push str.Failed_to_delete_service__s
lea ecx, [ebp - 0x184]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x184]
push edx
call fcn.00401000
add esp, 4
jmp 0x401f38
mov eax, dword [ebp + 8]
push eax
push str.Service__s_removed
lea ecx, [ebp - 0x200]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x200]
push edx
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x401f53
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401fa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push str.OpenSCManager_failed__error_code___d
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x84]
push edx
call fcn.00401000
add esp, 4
jmp 0x40207e
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push str.StopUpdates10_Guard
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x402020
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Failed_to_create_service__s__error_code___d
lea edx, [ebp - 0x108]
push edx
call fcn.0040372b
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
add esp, 4
jmp 0x402074
mov dword [ebp - 0x10c], str.StopUpdates10_permanently_blocks_Windows_Update_service
lea ecx, [ebp - 0x10c]
push ecx
push 1
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov eax, dword [ebp + 0xc]
push eax
push str.Service__s_installed
lea ecx, [ebp - 0x188]
push ecx
call fcn.0040372b
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x402c60
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409342
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x214], 0x40c968
cmp dword [ebp + 8], 0
jne 0x402c9c
xor al, al
jmp 0x402d93
cmp dword [ebp + 0xc], 1
jae 0x402caf
cmp dword [ebp + 0xc], 4
jbe 0x402caf
xor al, al
jmp 0x402d93
mov byte [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004036b0
add esp, 4
cmp eax, 0x190
jbe 0x402ceb
xor al, al
jmp 0x402d93
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push 0x40c98c
lea eax, [ebp - 0x210]
push eax
call fcn.0040372b
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402d7e
mov byte [ebp - 4], 1
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push 0x40c994
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x21c], 1
jmp 0x402d6a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402d86
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402da4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40934c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x214], str.SYSTEMCurrentControlSetServices_
cmp dword [ebp + 8], 0
jne 0x402de1
or eax, 0xffffffff
jmp 0x402ed9
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004036b0
add esp, 4
cmp eax, 0x190
jbe 0x402e21
or eax, 0xffffffff
jmp 0x402ed9
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push str._s_s
lea eax, [ebp - 0x210]
push eax
call fcn.0040372b
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push 0x20019
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402ec4
mov byte [ebp - 4], 1
mov dword [ebp - 0x224], 4
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Start
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x402eb0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402ecc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402eea
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov byte [ebp - 0x1fc], 1
mov byte [ebp - 0x1f8], 0
push 0x40d6e4
push 0x1f4
lea eax, [ebp - 0x1f8]
push eax
push 0x40e6fc
push str.WaasMedicSvc
push str.DisabledFeatures
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x1f8]
cmp ecx, 0x31
jne 0x402f3a
mov byte [ebp - 0x1fc], 0
mov al, byte [ebp - 0x1fc]
mov esp, ebp
pop ebp
ret

Function at 0x402f44
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a8
mov byte [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x402f63
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x403134
mov ecx, dword [ebp - 4]
push ecx
push str.Service_d
lea edx, [ebp - 0x5f8]
push edx
call fcn.0040372b
add esp, 0xc
mov byte [ebp - 0x400], 0
push 0x40d6e4
push 0x1f4
lea eax, [ebp - 0x400]
push eax
push 0x40e700
lea ecx, [ebp - 0x5f8]
push ecx
push str.UserServ
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx edx, byte [ebp - 0x400]
test edx, edx
je 0x40312f
lea eax, [ebp - 0x400]
push eax
call fcn.00402da4
add esp, 4
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jle 0x40312f
cmp dword [ebp - 0x5fc], 4
je 0x40312f
push 4
lea ecx, [ebp - 0x400]
push ecx
call fcn.00402c60
add esp, 8
mov byte [ebp - 8], 1
lea edx, [ebp - 0x400]
push edx
push str.Service_blocked:___s
lea eax, [ebp - 0x208]
push eax
call fcn.0040372b
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call fcn.00401000
add esp, 4
mov dword [ebp - 0x8a8], 0x44
mov dword [ebp - 0x8a4], 0
mov dword [ebp - 0x8a0], 0x40e704
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x898], 0
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 1
mov word [ebp - 0x878], 0
mov word [ebp - 0x876], 0
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 0
lea edx, [ebp - 0x400]
push edx
push str.sc.exe_stop__s
lea eax, [ebp - 0x854]
push eax
call fcn.0040372b
add esp, 0xc
lea ecx, [ebp - 0x864]
push ecx
lea edx, [ebp - 0x8a8]
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40312f
mov byte [ebp - 8], 1
jmp 0x402f5a
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4065fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edx
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
invalid
stosb byte es:[edi], al
Function at 0x407560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x408358
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00406136
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x4075d2
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
invalid
invalid
invalid

Function at 0x407d3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
std
add eax, dword [eax]
add byte [ebx - 0x6fb43], al
inc dword [ecx]
jne 0x407df1
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004061d5
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00406136
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x40813d
cmp dword [ebp - 0x6fc], 2
jne 0x407eae
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.004061c5
scasd eax, dword es:[edi]
sub al, 0xe
dec ecx
push 0xc
lea eax, [ebp - 0x79c]
push eax
call fcn.004061d5
cmp dword [ebp - 0x6fc], 3
jne 0x407f4f
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
invalid
test dword [edx - 8], ebx
invalid
Function at 0x401950
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
mov esi, dword [ebp + 8]
or byte [edi - 0x75], dl
cmp eax, sym.imp.USER32.dll_LoadStringA
push 0x64
push 0x406f58
push 0x69
push esi
call edi
push 0x64
push 0x406ef0
push 0x67
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x6b
push esi
mov dword [ebp - 0x54], 0x30
mov dword [ebp - 0x4c], 0x401620
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 3
call edi
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x6c
push esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 0x69
mov dword [ebp - 0x2c], str.Latgoback
call edi
push str.riched32.dll
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Lowster
push str.Latgoback
push 0
mov dword [0x406d3e], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x401a8d
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call esi
test eax, eax
je 0x401a82
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call edi
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call esi
test eax, eax
jne 0x401a62
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403030
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x406fe4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x406fe0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x406ff0], eax
call fcn.00401bd5
cmp dword [0x406dac], ebx
jne 0x40306b
push section..text
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00402dd0
push 0x40600c
push 0x406008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x406fdc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x406fd8]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x406004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x4030fe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4030d2
cmp al, 0x22
jne 0x4030c4
cmp byte [esi], 0x22
jne 0x4030db
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4030e5
cmp al, 0x20
jbe 0x4030d7
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403109
movzx eax, word [ebp - 0x2c]
jmp 0x40310c
cmp byte [esi], 0x20
jbe 0x4030db
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4030fe
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]