joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4437f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457200]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x443888
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x443868
xor eax, eax
push ebp
push 0x443861
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4438a4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443868
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x457200]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457200], ax
mov esp, ebp
pop ebp
ret

Function at 0x445ba8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x445c90
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x45b17c], 1
jae 0x445c82
xor eax, eax
mov dword [0x45ad88], eax
xor eax, eax
mov dword [0x45ad90], eax
xor eax, eax
mov dword [0x45ad94], eax
mov byte [0x45ad9a], 2
mov byte [0x45ad9b], 2
mov byte [0x45ad9c], 3
mov word [0x45b144], 0
mov word [0x45b154], 1
mov word [0x45b164], 0xa
mov dword [0x45b16c], 0x80020004
mov dword [0x45b138], 0x444f84
mov dword [0x45b13c], 0x444f7c
mov dword [0x45b140], 0x444f84
call fcn.004437c0
test al, al
je 0x445c41
call fcn.004437f0
call fcn.004438b4
mov eax, 0x45ada0
mov edx, 0x445c9c
call fcn.004410d6
mov eax, 0x45af6c
mov edx, 0x445c9c
call fcn.004410d6
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x45ad80], eax
call fcn.0044203c
mov dword [0x45ad7c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x45ad74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445c97
ret

Function at 0x447968
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x447984
call fcn.00448b48
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4479a0
test bl, 1
je 0x4479a0
call fcn.0044ed50
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x447b6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0044871c
test byte [ebp + 0xd], 0xc0
jne 0x447b90
mov eax, dword [0x457f74]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x447b9d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x447bca
je 0x447bdc
sub ecx, 0x100
je 0x447bea
sub ecx, 0x100
je 0x447bf1
sub ecx, 0x100
je 0x447be3
jmp 0x447bf8
sub ecx, 0x600
je 0x447bf1
sub ecx, 0x100
je 0x447bdc
jmp 0x447bf8
mov edi, 1
jmp 0x447bfd
mov edi, 2
jmp 0x447bfd
mov edi, 4
jmp 0x447bfd
mov edi, 5
jmp 0x447bfd
mov edi, 3
test byte [ebp + 0xd], 1
je 0x447c24
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4579f0]
test al, 0x80
je 0x447c1d
mov ebx, 0x80
jmp 0x447c36
mov ebx, 1
jmp 0x447c36
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x447c36
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x447c48
je 0x447c51
dec eax
je 0x447c5a
jmp 0x447c63
mov dword [ebp - 4], 0x80000000
jmp 0x447c72
mov dword [ebp - 4], 0x40000000
jmp 0x447c72
mov dword [ebp - 4], 0xc0000000
jmp 0x447c72
push 1
call fcn.00448adc
pop ecx
mov ebx, eax
jmp 0x447d5e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x447c8e
sub eax, 0x10
je 0x447c95
sub eax, 0x10
je 0x447c9e
sub eax, 0x10
je 0x447ca7
jmp 0x447ca7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x447cae
mov dword [ebp - 8], 1
jmp 0x447cae
mov dword [ebp - 8], 2
jmp 0x447cae
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x447d17
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x447d0c
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x447d0c
add ebx, 0xffffffb2
push ebx
call fcn.00448adc
pop ecx
mov ebx, eax
jmp 0x447d5e
mov edi, esi
push edi
call fcn.00447ad0
pop ecx
test eax, eax
je 0x447d2b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x447d37
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0044881c
add esp, 8
mov ebx, eax
inc eax
jne 0x447d5e
push 4
call fcn.00448adc
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00448750
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bac4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004466dc
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0044676c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0044676c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x458a71
lea ecx, [ebp - 0x200]
push ecx
call fcn.004466dc
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0044676c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0044cc58
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x44bbd5
push esi
call fcn.0044676c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0044676c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00446160
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x44bbac
xor eax, eax
jmp 0x44bc5c
push esi
call fcn.0044676c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0044676c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00446638
add esp, 0xc
jmp 0x44bc15
mov edi, dword [ebx + 0x24]
push edi
call fcn.0044676c
pop ecx
push eax
push esi
call fcn.0044676c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0044676c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00446180
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x44bc15
xor eax, eax
jmp 0x44bc5c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004466dc
add esp, 8
push 0x458a73
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004466dc
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004466dc
add esp, 8
push 0x458a75
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004466dc
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44eae8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x459034], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x44eba0
cmp byte [0x4552b3], 0
je 0x44eb5a
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0044ea34
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44eb43
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0044ea34
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44eb43
lea ebx, [ebp - 0x54]
jmp 0x44eb44
inc ebx
call fcn.0044eaa0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x44ebc1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x459038
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0044676c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45903b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x44ebc1
cmp dword [0x459034], 0xffffffff
je 0x44ebc1
mov eax, dword [0x459034]
test eax, eax
je 0x44ebc1
cmp byte [eax], 0
je 0x44ebc1
push esi
push eax
call fcn.0044ec40
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44ec40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x44eca2
call fcn.0044ebf0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0044676c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0044676c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44f200
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x45ba7c], 0
jne 0x44f281
cmp dword [0x45ba98], 0
jne 0x44f230
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x45ba98], eax
test eax, eax
jne 0x44f230
push str.GetEnvironmentStrings_failed
call fcn.0044ebd8
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x45ba98]
jmp 0x44f244
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0044676c
pop ecx
mov edi, eax
test eax, eax
jne 0x44f23c
lea edi, [ebp + 1]
push edi
call fcn.00446160
pop ecx
mov ebx, eax
mov dword [0x45ba80], ebx
test ebx, ebx
jne 0x44f26e
xor eax, eax
jmp 0x44f344
push edi
mov edx, dword [0x45ba98]
push edx
push ebx
call fcn.004465c8
add esp, 0xc
jmp 0x44f2a1
xor esi, esi
mov ebx, dword [0x45ba7c]
jmp 0x44f29b
push eax
call fcn.0044676c
pop ecx
test eax, eax
jne 0x44f297
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x44f28b
lea ebx, [esi + 4]
push 4
mov dword [0x45ba84], ebx
inc ebx
push ebx
call fcn.00445ca0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x44f2c4
xor eax, eax
jmp 0x44f344
cmp dword [0x45ba7c], 0
jne 0x44f2f5
xor esi, esi
mov ebx, dword [0x45ba80]
mov eax, dword [esp]
mov ebp, eax
jmp 0x44f2e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0044676c
pop ecx
mov edi, eax
test eax, eax
jne 0x44f2dc
jmp 0x44f326
xor esi, esi
mov ebx, dword [0x45ba7c]
mov eax, dword [esp]
mov edi, eax
jmp 0x44f320
push eax
call fcn.0044676c
pop ecx
test eax, eax
je 0x44f315
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x44f319
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x44f304
mov eax, dword [0x45ba7c]
test eax, eax
je 0x44f336
push eax
call fcn.00446170
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x45ba7c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x417b94
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov al, 0x3f
add dword [eax - 0x4d0fb6bf], esi
mov bl, 0xb3
sbb al, 0xe0
mov ch, 0xb4
mov ah, 6
cmp eax, 0xf5313bc1
xor ebp, esi
mov ah, 0xb3
leave
aaa
xor ebp, esi
mov ah, 0x41
cmp esp, ebx
lodsd eax, dword [esi]
mov bl, 0xb3
sbb al, 0x9c
mov bh, 0xb4
mov ah, 4
pop es
mov bl, 0xc9
sbb esi, dword [ecx]
cmc
mov ah, 0x3e
inc ecx
invalid
inc ecx
dec ecx
les esi, [ecx + 0x607b3b3]
cmp al, 0x41
les esi, [ecx - 0x364c4c4d]
leave
aas
xor ebp, esi
cmc
mov ah, 0x37
jge 0x417b4c
inc ecx
jno 0x417b60
mov cl, 0xb3
mov bl, 0xe7
je 0x417be3
dec ecx
invalid
pop eax
jae 0x417b64
sub dh, ch
mov ah, 0x37
jge 0x417b82
cmpsb byte [esi], byte es:[edi]
bound ebp, qword [ebx + 0x3faddf85]
stosd dword es:[edi], eax
aas
scasb al, byte es:[edi]
aas
test dword [edi], esi
jge 0x417b91
cmpsb byte [esi], byte es:[edi]
bound edi, qword [edi]
jle 0x417be6
jne 0x417b82
mov dh, 0xa7
cmpsd dword [esi], dword es:[edi]
pop ecx
aas
jle 0x417c2c
dec ecx
invalid

Function at 0x417bc6
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov al, 0x3f
add dword [eax - 0x4d0fb6bf], esi
mov bl, 0xb3
sbb al, 0xe0
mov ch, 0xb4
mov ah, 6
cmp eax, 0xf5313bc1
xor ebp, esi
mov ah, 0xb3
leave
aaa
xor ebp, esi
mov ah, 0x41
cmp esp, ebx
lodsd eax, dword [esi]
mov bl, 0xb3
sbb al, 0x9c
mov bh, 0xb4
mov ah, 4
pop es
mov bl, 0xc9
sbb esi, dword [ecx]
cmc
mov ah, 0x3e
inc ecx
invalid
inc ecx
dec ecx
les esi, [ecx + 0x607b3b3]
cmp al, 0x41
les esi, [ecx - 0x364c4c4d]
leave
aas
xor ebp, esi
cmc
mov ah, 0x37
jge 0x417b4c
inc ecx
jno 0x417b60
mov cl, 0xb3
mov bl, 0xe7
je 0x417be3
dec ecx
invalid
pop eax
jae 0x417b64
sub dh, ch
mov ah, 0x37
jge 0x417b82
cmpsb byte [esi], byte es:[edi]
bound ebp, qword [ebx + 0x3faddf85]
stosd dword es:[edi], eax
aas
scasb al, byte es:[edi]
aas
test dword [edi], esi
jge 0x417b91
cmpsb byte [esi], byte es:[edi]
bound edi, qword [edi]
jle 0x417be6
jne 0x417b82
mov dh, 0xa7
cmpsd dword [esi], dword es:[edi]
pop ecx
aas
jle 0x417c2c
dec ecx
invalid

Function at 0x417c1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
aas
jle 0x417c55
xchg ebp, eax
mov bh, 4
cmpsd dword [esi], dword es:[edi]
pop eax
push ds
mov esp, 0x3133c9b3
cmc
mov ah, 4
mov bl, 0xc9
sub esi, dword [ecx]
cmc
mov ah, 0x41
inc ecx
sbb al, 0xb3
mov bl, 0xb3
pop es
inc ecx
dec ecx
fsubr qword [ebp + 0x605b3b3]
aas
movsb byte es:[edi], byte [esi]
mov bl, 0xc9
leave

Function at 0x417c45
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cmc
mov ah, 0x3f
lodsb al, byte [esi]
push ebp
jae 0x417c78
cmc
mov ah, 7
pop es
add al, 0xb
mov bl, 0xc9
and esi, dword [ecx]
cmc
mov ah, 0x3f
leave
ja 0x417c88
cmc
mov ah, 0x41
add dword [edi + eax + 0xb0a0605], ebp
mov bl, 0xc9
daa
xor ebp, esi
mov ah, 0xb
mov bl, 0xc9
pop ss
xor ebp, esi
mov ah, 0x41
cmp dword [ebx + esi*4], ebx
mov bl, 0xb3
sbb al, 0xb5
les esi, [esp + esi*4 - 0x4d0fbebf]
mov bl, 0xb3
add al, 5
mov bl, 0xb3
mov bl, 0x1c
mov ch, 0xc4
mov ah, 0xb4
inc ecx
inc ecx
invalid
mov bl, 0xc9
rdtsc
cmc
Function at 0x402d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test byte [0x407080], 1
jne 0x402d3c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__semi_stub:_no_script_engine_clean_up_n
mov dword [esp + 8], str.Host_Quit
mov dword [esp + 4], 0x407080
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x402d33
Function at 0x403e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x403ec8
cmp byte [esi + ebx - 1], 0xa
je 0x403e9c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40717c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4066f0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40677b
cmp ax, 9
je 0x406768
cmp ax, 0x20
je 0x406768
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4067d0
cmp ax, 0x22
je 0x4067e0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40677b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x406720
test edi, 1
jne 0x406720
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x406768
cmp ax, 0x20
je 0x406768
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x4067f8
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40673b
and dword [ebp - 0x54], 1
jne 0x406734
xor edi, 1
jmp 0x40673b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x406794

Function at 0x406810
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x404440
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404520
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404520
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40448a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404491
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404470
jmp 0x404493
mov esi, 0x1505
jmp 0x404493
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404520
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4044c4
inc edi
dec ebx
je 0x40451e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40451e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4044c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4044c0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cda0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4044c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404520
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404530
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404631
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404631
push ebx
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x40458a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404591
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404570
jmp 0x404593
mov esi, 0x1505
jmp 0x404593
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404631
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4045c4
inc ebp
dec ebx
je 0x40462f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40462f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4045c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4045c0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4045c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40462f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x404631
mov edi, dword [eax + 8]
jmp 0x404631
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404660
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4046cb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4046cb
push esi
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x4046aa
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4046b1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x404690
jmp 0x4046b3
mov ebp, 0x1505
jmp 0x4046b3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4046d7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4046f4
inc ebx
dec edi
je 0x4046cb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4046cb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4046f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4046f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040cda0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4046f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4046cb
cmp dword [eax + 4], 3
jne 0x4046cb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4046cb

Function at 0x404790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404891
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404891
push ebx
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x4047ea
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4047f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4047d0
jmp 0x4047f3
mov esi, 0x1505
jmp 0x4047f3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404891
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404824
inc ebp
dec ebx
je 0x40488f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40488f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404820
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404820
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40488f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x404891
mov edi, dword [eax + 8]
jmp 0x404891
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret