joyce8/EMBER2024-capa huggingface dataset:
Function at 0x712661
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
ror eax, 1
bts dx, 0x3a
rol edx, cl
xor ebx, eax
imul edx, edx
mov dword [esp], ecx
add ebp, eax
pop eax
pop edx
pop ecx
jmp ebp

Function at 0x712679
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
or byte [eax], al
and bh, dh
salc
jp 0x71262c
invalid
and al, 3
call 0xffca80d0
in eax, 0x89
invalid
mov word [edx + eax*8], cs
jno 0x712671
mov dword [esp + ecx - 0x40d8e3e], ecx
sti
mov cx, word [eax + ecx*8 - 0x206c71f0]
sub edi, 2
call fcn.005fb4fe
pop edi
loope 0x712671
jg 0x71265d
mov esi, 0xbcc552d0
push esp
out 0x48, al
popal
lds esi, [ebx]
jge 0x71263e
cmp al, bh
aaa
add eax, 0xc03aa8c9
push es
sub byte [esi + 0x64bb153a], 0xc5
inc ebx
and bl, byte [esi]
jp 0x7126bc
and al, 0x17
add eax, 0x1b5a783
inc edx
loop 0x71270d
push 0xffffffffffffffb1
unpckhps xmm1, xmm7
in eax, 0x40
stosd dword es:[edi], eax
hlt
rcr byte [edi + edi], 1
push ebx
popfd
sub cl, byte [edx + ebx*2 - 0x64afad3d]
dec esi
push ss
push eax
mov bl, 0xe
invalid

Function at 0x71dee3
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor edx, ebx
mov dword [esp + ecx*2 - 0x2f3af810], 0x5a2d829
neg dword [esp + ecx*4 - 0x5e75f020]
sbb edx, 0xa80a5996
not edx
lea eax, [ecx + ecx*2 + 0x78067312]
lea edx, [ecx + edx - 0x110c6cf7]
not dword [esp + ecx - 0x179d7c08]
neg ecx
sub al, byte [esp + 2]
bswap edx
xor ebx, edx
add edi, edx
shl eax, 0x3d
pop ecx
mov ebp, dword [ecx + ebp - 0x5a2d828]
movsx edx, cx
dec ax
dec al
jle fcn.006467aa

Function at 0x72a8f7
Capabilities:
Authenticate hmac
Read file on windows

Disassembly:
lea ebp, [ebp + ecx - 0x1d]
push edx
push ecx
adc dl, byte [esp + ecx - 0x21]
xor eax, ebx
xadd dword [esp + ecx*8 - 0x104], ecx
xor eax, 0x508d7918
xchg word [esp], dx
sub dword [esp + 1], 0x1cb1552a
sbb eax, 0x91b5c609
neg eax
inc eax
sal ecx, 0x34
ror eax, 1
bswap edx
xor eax, 0xf92ce69b
inc ecx
xadd byte [esp + edx - 0x2100fffa], dh
adc byte [esp + edx - 0x2100f7f8], cl
not eax
xor dx, dx
and byte [esp + edx - 0x20ffffff], 0x84
bts edx, edx
lea eax, [edx + eax + 0x108944a4]
neg eax
sar dx, cl
and dword [esp + edx - 0x20fffffc], edx
jae 0x63db3c
mov dl, byte [ebp + 2]
lea eax, [eax*4 - 0x49cf345f]
je 0x5a513c
adc ebp, 2
lea eax, [eax*4 - 0x22790479]
ror al, 0xe4
btr eax, eax
adc cl, dl
mov word [ebp], cx
movzx edx, al
and edx, dword [esp + edx - 0xb1]
mov dword [esp + edx - 0xb1], esi
ret
dec ecx
pop eax
mov eax, edx
mov dword [esp], eax
ror ecx, 1
cbw
xor ebx, ecx
add esi, ecx
idiv byte [esp + 2]
movzx cx, byte [ebp]
xor ax, word [esp + 1]
jne 0x64e147

Function at 0x7362e2
Capabilities:
Read file on windows

Disassembly:
or edx, 0xeebb110b
neg eax
ror eax, 2
rol dl, 3
xadd cx, dx
xor ebx, eax
mov dword [esp], 0x64a8ef29
sal cx, 0xcc
jb 0x663096

Function at 0x743988
Capabilities:
Read file on windows

Disassembly:
ror eax, 2
neg eax
ror eax, 1
call fcn.005aab61
xor eax, ebx
sar ecx, cl
lea eax, [eax + ecx - 0x3dfe16f2]
bt dx, dx
mov dword [esp], 0xc327bf18
jae 0x6d63e0
Function at 0x749457
Capabilities:
Encrypt data using speck

Disassembly:
push edx
mov dword [esp + edx - 0x4dbbd7ca], edx
mov word [edx + ebp - 0x4dbbd7ce], ax
lea eax, [edx + edx - 0x3e6914f1]
xchg dword [esp + eax - 0x5d0e9aa7], edx
lea edi, [edx + edi - 0x4dbbd7d2]
mov edx, dword [edi + eax - 0x5d0e9aab]
xor edx, ebx
movzx ecx, ax
sal eax, 0xa1
call fcn.00658e5d

Function at 0x749cab
Capabilities:
Create thread

Disassembly:
call fcn.00619e16
jmp 0x745676

Function at 0x74c05e
Capabilities:
Get number of processors

Disassembly:
mov dword [esp + 8], 0x2ebc730e
neg dword [esp + 8]
mov dword [esp + 8], 0x5bad3dd1
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0074fa10

Function at 0x74df00
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [ebp + eax - 0xf0]
call fcn.006a3258

Function at 0x756fe4
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
or edx, 0x89b5763e
or cl, al
call fcn.006e7704
test ecx, 0xe3309da2

Function at 0x759bbd
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
bswap edx
add edx, 0x9700908b
xor edx, 0x270303b9
add edx, eax
lea ecx, [ecx*2 - 0x597cc87e]
xor ebx, edx
mov dword [esp + eax*8 - 4], eax
add ebp, edx
mov edx, 0xcba06c39
call fcn.00638a99
mov ecx, 0xf8aa5d16
xchg ch, cl
mov ecx, dword [edi]
push 0xf73e1007
mov eax, dword [edi + 4]
call fcn.005ecad2
xor eax, ebx
mov edx, 0x3335681
lea ecx, [edx*8 + 0x681b441e]
dec eax
sub ecx, edx
call fcn.00727fa5

Function at 0x75a6c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
jmp edi
mov ecx, dword [ebp + edx - 0x1233ccf2]
mov edx, dword [ebp + edx*2 - 0x246799e0]
not ax
add ebp, 8
lea eax, [eax*2 - 0x617e2863]
mov dword [esp], eax
or al, byte [esp + 2]
mov dword ss:[ecx], edx
jno 0x5f94c1

Function at 0x75cf1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00760d6e
mov eax, dword [esi]
add esi, 4
mov ecx, 0xd5a8b392
sub edi, 1
jmp 0x750249
sub ecx, ecx
movzx edx, byte [edi + ecx*2]
bt cx, 0xb2
sbb ecx, ecx
inc cx
xor dl, bl
add dl, cl
neg dl
xor cl, 0xab
inc dl
sar cx, cl
xor dl, 0x1c
xor bl, dl
sub cx, 0xe717
jne 0x5f8025
mov edx, 0xa92febb8
movzx ecx, dx
movzx ax, byte [esi + ecx*2 - 0x1d770]
btr edx, 9
mov cl, byte [esi + ecx - 0xebb6]
adc esi, 1
shr edx, 0xcc
add al, cl
mov word [edx + esi - 0xa92fe], ax
lea edi, [edi + edx*4 - 0x2a4bfc]
jmp 0x5b2d55
mov edx, dword [edx + ebp - 0x794e5307]
xor word [esp + 6], cx
mov ecx, dword [ebp + 4]
call fcn.00631f26
mov ecx, dword [edi]
mov eax, 0xd1067733
neg ax
mov eax, dword [edi + 4]
jbe 0x6a2830
mov ecx, 0xd1837897
mov ecx, dword [ebp]
mov eax, 0xeb1b5102
mov eax, dword [ebp + 4]
push 0x82ad8297
imul ecx
mov ecx, dword [esp]
mov dword [ebp], edx
movsx edx, word [esp]
rol ecx, cl
call fcn.00645861
jmp 0x701276

Function at 0x760e0f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x1c414d88], edx
neg byte [esp + edx - 0x1c414d88]
pop eax
jb fcn.006b4dbe
jmp ebp
Function at 0x401c30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x812c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
lea edi, [ebp - 0x8018]
xor ebx, ebx
mov esi, 0x7fff
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 4], edi
mov ecx, 0x7fff
mov dword [esp + 8], ecx
mov dword [esp], str.Launch4j
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov eax, dword [ebp + 8]
sub esp, 0xc
mov edx, str.__l4j_debug
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401d86
lea ebx, [ebp - 0x8128]
mov edx, 0x104
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov esi, 0x6f6c2e6a
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp], ebx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x75616c5c
mov edx, 0x3468636e
mov ecx, 0x407090
mov dword [eax + ebx + 4], edx
mov dword [eax + ebx + 8], esi
mov word [eax + ebx + 0xc], 0x67
mov dword [esp], ebx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
mov dword [0x408090], eax
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d7e
mov eax, dword [ebp + 8]
mov ecx, str.__l4j_debug_all
xor esi, esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401da7
mov esi, 1
mov dword [0x408028], esi
test ebx, ebx
je 0x401d79
mov dword [esp], ebx
mov esi, str.3.12
mov edi, str._n_nVersion:_t_s_n
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll_fprintf
mov eax, dword [0x408090]
test eax, eax
je 0x401d79
mov dword [esp], eax
mov edx, dword [ebp + 8]
mov ebx, str.CmdLine:_t_s__s_n
mov dword [esp + 4], ebx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
call sub.msvcrt.dll_fprintf
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov edx, str.debug
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401c95
mov ebx, dword [0x408090]
jmp 0x401d33
mov dword [esp], edi
mov edx, str.debug_all
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401d28
jmp 0x401d2d
Function at 0x402ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov eax, dword [0x4102d0]
cmp eax, 9
je 0x402f81
cmp eax, 2
je 0x402f10
jle 0x402ef0
cmp eax, 3
je 0x402fb6
cmp eax, 4
je 0x402f1a
mov eax, dword [0x408090]
test eax, eax
jne 0x402f52
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
dec eax
jne 0x402ed8
mov edi, dword [0x408020]
test edi, edi
je 0x402ee1
mov eax, ebx
or eax, 0x100
mov dword [esp + 4], eax
jmp 0x402f1e
mov edx, dword [0x408020]
test edx, edx
jne 0x402f33
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402a90
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
mov ecx, ebx
or ecx, 0x100
mov dword [esp + 4], ecx
call fcn.00402a90
test byte [0x4102d5], 1
jne 0x402ee1
jmp 0x402f1a
mov dword [esp + 0xc], eax
mov esi, 0x1e
mov ebx, 1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.Runtime_bits:_tFailed_to_load._n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
xor eax, eax
lea edx, [ebp - 0x38]
mov ecx, 5
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
mov dword [esp], 0x1e
call fcn.004020c0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0x4102d0], eax
jmp 0x402ec3
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402a90
mov eax, dword [0x4102d4]
test eax, eax
je 0x402ef3
test ah, 1
je 0x402ee1
jmp 0x402ef3
Function at 0x403900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov eax, dword [ebp + 8]
mov dword [esp], 0xc
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.004020c0
test eax, eax
je 0x40393a
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp + 8]
mov word [eax + edx], 0x20
lea ebx, [ebp - 0x128]
mov edx, 0x104
xor eax, eax
mov dword [esp + 8], edx
mov edi, 0x696e69
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
sub eax, 3
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x2e6a346c
mov dword [eax + ebx + 4], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov dword [ebp - 0x12c], eax
inc eax
je 0x403a79
mov eax, dword [0x408090]
test eax, eax
jne 0x403a84
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov esi, dword [ebp + 8]
mov edx, 0x7c00
sub edx, eax
mov dword [esp + 8], edx
add esi, eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], esi
mov edi, esi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov dword [ebp - 0x130], eax
mov ecx, 1
test eax, eax
mov dword [ebp - 0x134], ecx
jle 0x403a44
mov ebx, eax
nop
lea esi, [esi]
movzx ecx, byte [esi]
cmp cl, 0x23
je 0x403ab0
cmp cl, 0xd
sete al
cmp cl, 0xa
sete dl
or eax, edx
test al, 1
je 0x403aa0
cmp edi, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x134], ecx
jbe 0x403a40
cmp byte [edi - 1], 0x20
je 0x403a40
mov byte [edi], 0x20
inc edi
lea esi, [esi]
inc esi
dec ebx
jne 0x403a00
mov byte [edi], 0
mov ebx, dword [ebp - 0x130]
test ebx, ebx
jle 0x403a6b
cmp byte [edi - 1], 0x20
je 0x403a6b
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edi, dword [ebp + 8]
mov word [eax + edi], 0x20
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call sub.msvcrt.dll__close
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov ebx, str.Loading:_t_s_n
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4039b2
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x403a40
mov byte [edi], cl
jmp 0x403a3b
xor ecx, ecx
mov dword [ebp - 0x134], ecx
jmp 0x403a40
Function at 0x403c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x815c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
mov ebx, dword [0x408028]
mov eax, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 0x814c], eax
je 0x403cb0
mov eax, dword [0x408090]
test eax, eax
jne 0x403e80
mov ebx, 0x104
lea edx, [ebp - 0x128]
xor esi, esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x148]
mov edi, ebx
mov dword [esp], edx
mov dword [esp + 4], esi
mov esi, ebx
call sub.msvcrt.dll_memset
cld
xor eax, eax
mov ecx, 5
rep stosd dword es:[edi], eax
mov dword [esp + 4], ebx
mov edi, 0x407166
mov dword [esp], 0x1d
call fcn.004020c0
cld
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [0x408020]
seta dl
setb cl
xor ebx, ebx
cmp dl, cl
sete bl
test esi, esi
sete dl
xor eax, eax
test ebx, ebx
setne al
test edx, eax
je 0x403d60
mov eax, dword [0x408090]
test eax, eax
jne 0x403d37
xor eax, eax
add esp, 0x815c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], eax
mov edi, 0x35
mov ecx, 1
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], str.Bundled_JRE:_tCannot_use_64_bit_runtime_on_32_bit_OS._n
call sub.msvcrt.dll_fwrite
jmp 0x403d2a
mov dword [esp], 1
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
call fcn.004020c0
test eax, eax
je 0x403d2a
mov edx, 0x8000
xor eax, eax
lea esi, [ebp - 0x8148]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp], esi
mov edi, dword [ebp - 0x814c]
lea edx, [ebp - 0x128]
mov dword [esp + 4], edx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
call fcn.004033a0
mov eax, dword [0x408090]
test eax, eax
jne 0x403ebc
cmp byte [ebp - 0x8148], 0x5c
je 0x403ea7
cmp byte [ebp - 0x8147], 0x3a
je 0x403ea7
mov dword [esp], 0x4081a4
mov eax, dword [ebp - 0x814c]
mov edi, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
call sub.msvcrt.dll_strncpy
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strlen
cmp byte [eax + 0x4081a3], 0x5c
je 0x403e1f
mov edx, 0x5c
mov word [eax + 0x4081a4], dx
mov dword [esp + 4], esi
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strcat
mov dword [esp], 0x4081a4
call fcn.00402840
test eax, eax
je 0x403d2a
mov dword [esp], 0x410664
cmp ebx, 1
mov esi, 0x4081a4
mov dword [esp + 4], esi
sbb ebx, ebx
and ebx, 0xffffff00
add ebx, 0x104
mov dword [0x4102d4], ebx
call sub.msvcrt.dll_strcpy
mov eax, 1
jmp 0x403d2c
mov dword [esp + 0xc], eax
mov ecx, 0x13
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], str.bundledJreSearch___n
call sub.msvcrt.dll_fwrite
jmp 0x403cb0
mov dword [esp + 4], esi
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strcpy
jmp 0x403e2f
mov dword [esp + 8], esi
mov ecx, str.Bundled_JRE:_t_s_n
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403dc7
Function at 0x404610
Capabilities:
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
mov edi, dword [ebp + 0xc]
mov eax, 0x8000
xor ebx, ebx
mov dword [esp + 4], ebx
lea esi, [ebp - 0x8018]
lea ebx, [ebp - 0x10018]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp], ebx
mov ecx, 0x7fff
xor edx, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memset
mov dword [esp + 4], ebx
mov dword [esp], 0x13
call fcn.004020c0
mov dword [esp], ebx
mov eax, 0x40759f
mov dword [esp + 4], eax
jmp 0x40469f
mov dword [esp], ebx
mov ebx, 0x40759f
mov dword [esp + 4], esi
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.msvcrt.dll_strtok
test eax, eax
mov ebx, eax
je 0x404704
mov dword [esp], eax
mov ecx, 0x3d
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strchr
mov byte [eax], 0
mov edx, dword [ebp + 8]
inc eax
mov byte [ebp - 0x8018], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004033a0
mov eax, dword [0x408090]
test eax, eax
je 0x404680
mov dword [esp + 0xc], esi
mov edx, str.Set_var:_t_s___s_n
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x404680
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4054c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x808c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
cld
mov edx, 0x44
xor eax, eax
lea esi, [ebp - 0x68]
xor ebx, ebx
mov edi, 0x4102b0
mov ecx, 4
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
xor edi, edi
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x8068]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x68], 0x44
mov eax, 0x8000
mov dword [esp + 4], edi
mov edi, 0x4102b0
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov ecx, 0x22
mov edx, 0x4081a4
mov word [ebp - 0x8068], cx
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0x2022
mov byte [eax + ebx + 2], 0
mov eax, 0x4082a8
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 0x20], esi
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x24], edi
mov eax, 1
xor edi, edi
mov dword [esp + 0x1c], esi
xor esi, esi
mov dword [esp + 0x18], ecx
mov edx, dword [0x4102c0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x4055d0
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4055e3
mov ebx, dword [ebp + 0xc]
mov eax, 1
mov dword [ebx], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [edx], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0xffffffff
mov dword [esp + 4], esi
mov eax, dword [0x4102b0]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
mov edi, dword [ebp + 0xc]
sub esp, 8
mov dword [esp + 4], edi
mov ecx, dword [0x4102b0]
mov dword [esp], ecx
call sub.KERNEL32.dll_GetExitCodeProcess
mov edx, dword [0x4102b4]
sub esp, 8
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [0x4102b0]
sub esp, 4
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 1
jmp 0x4055c2
Function at 0x405670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.004058d0
call fcn.00405860
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4056a8
jmp 0x405746
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4056a7
cmp cl, 0x22
je 0x405700
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x405720
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x405720
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x4056e0
jmp 0x405720
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x405700
cmp cl, 0x22
je 0x405782
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x405740
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x405730
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x405764
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004013b0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x405720
Function at 0x5b4370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5b438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x5dd074
push ecx
mov edi, eax
call fcn.005c8198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5b43cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.005c802e
push esi
call fcn.005c7fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x5b7850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x5b78ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x5e2720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5b78ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.005c81e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x5b78ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x5e2720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5b792a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.005c9082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x5b7957
mov word [eax], si
add eax, 2
push eax
call fcn.005c9030
add esp, 4
jmp 0x5b7959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x5b78ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x5b78b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x5b7ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret