joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40beb0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4284c8
push 0x416480
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x84f0
call fcn.004207e0
mov eax, dword [0x42a520]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
push 6
push 0x4267d4
push esi
call fcn.0041196f
add esp, 0xc
test eax, eax
je 0x40c0ce
call fcn.00409740
xor eax, eax
mov word [ebp - reloc.kernel32.dll_IsDBCSLeadByte], ax
push 0x206
push ebx
lea ecx, [ebp - 0x4ae]
push ecx
call fcn.00412510
add esp, 0xc
push 0x104
lea edx, [ebp - 0x4b0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40c0ed
xor eax, eax
mov word [ebp - reloc.kernel32.dll_IsDBCSLeadByte], ax
push 0x206
push ebx
lea ecx, [ebp - 0x2a6]
push ecx
call fcn.00412510
add esp, 0xc
lea edx, [ebp - 0x2a8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40c0ed
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40c0ed
call fcn.004079c0
test eax, eax
je 0x40c0ed
mov byte [ebp - 0xa0], bl
push 0x80
push ebx
lea edx, [ebp - 0x9f]
push edx
call fcn.00412510
add esp, 0xc
mov dword [ebp - 0x84b4], 0x81
lea edx, [ebp - 0x84b4]
lea eax, [ebp - 0xa0]
call fcn.0040a290
test eax, eax
je 0x40c0ed
lea ecx, [ebp - 0x2a8]
lea edx, [ebp - 0x4b0]
call fcn.0040ba60
test eax, eax
je 0x40c0ed
xor eax, eax
mov word [ebp - reloc.kernel32.dll_IsDBCSLeadByte], ax
push 0x7ffe
push ebx
lea ecx, [ebp - 0x84ae]
push ecx
call fcn.00412510
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
push str.__s____help_s_t_S
push 0x4000
lea edx, [ebp - 0x84b0]
push edx
call fcn.00411448
mov dword [ebp - 0x8508], ebx
push reloc.kernel32.dll_QueueUserAPC
push ebx
lea eax, [ebp - 0x8504]
push eax
call fcn.00412510
add esp, 0x30
mov dword [ebp - 0x8508], 0x44
xor ecx, ecx
mov word [ebp - reloc.kernel32.dll_IsDBCSLeadByte], cx
mov dword [ebp - 0x84dc], 1
mov dword [ebp - 0x84c4], ebx
xor eax, eax
mov dword [ebp - 0x84c0], eax
mov dword [ebp - 0x84bc], eax
mov dword [ebp - 0x84b8], eax
lea edx, [ebp - 0x84c4]
push edx
lea eax, [ebp - 0x8508]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x84b0]
push ecx
lea edx, [ebp - 0x2a8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x40c0ed
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040bae0
add esp, 4
jmp 0x40c0ed
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004106c7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f0b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421de8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x42b468
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004097b0
add esp, 8
lea ecx, [ebp - 0x18]
push 0x42b4cc
push ecx
mov byte [ebp - 4], 1
call fcn.004097b0
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [section..reloc]
mov eax, dword [edx + 0xc]
mov ecx, section..reloc
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00406ea0
add esp, 4
cmp eax, ebx
je 0x40f141
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.004069f0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x40f1cd
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x40f1cd
cmp dword [esi - 0xc], ebx
je 0x40f1cd
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x40f1cd
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.0040eff0
test eax, eax
jne 0x40f1b1
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x40f1b1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40f1b4
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x40f1c2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x40f160
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f1ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f210
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f232
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x69542d1f
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x518d77d9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4de110
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4bd015
lea edi, [esi - 0xbc015]
push edi
jmp 0x4de12a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4de131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4de120
mov eax, 1
add ebx, ebx
jne 0x4de143
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4de154
jne 0x4de173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4de173
dec eax
add ebx, ebx
jne 0x4de160
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4de138
add ebx, ebx
jne 0x4de16f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4de1c5
xor ecx, ecx
sub eax, 3
jb 0x4de18b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4de1fa
sar eax, 1
mov ebp, eax
jmp 0x4de196
add ebx, ebx
jne 0x4de196
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4de164
inc ecx
add ebx, ebx
jne 0x4de1a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4de164
add ebx, ebx
jne 0x4de1b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4de1a6
jne 0x4de1c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4de1a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4de1e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4de1d6
jmp 0x4de126
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4de1e4
add edi, ecx
jmp 0x4de126
pop esi
mov edi, esi
mov ecx, 0x3a39
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4de202
cmp byte [edi], 8
jne 0x4de202
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4de207
lea edi, [esi + 0xdc000]
mov eax, dword [edi]
or eax, eax
je 0x4de27f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xde590]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xde5cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4de234
mov ecx, edi
jns 0x4de263
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xde5d4]
or eax, eax
je 0x4de279
mov dword [ebx], eax
add ebx, 4
jmp 0x4de251
call dword [esi + 0xde5d0]
mov ebp, dword [esi + 0xde5d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4de2b3
sub esp, 0xffffff80
jmp 0x4024c0
Function at 0x41f890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x413015
lea edi, [esi - 0x12015]
push edi
or ebp, 0xffffffff
jmp 0x41f8b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f8b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f8a8
mov eax, 1
add ebx, ebx
jne 0x41f8cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f8c0
jne 0x41f8dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f8c0
xor ecx, ecx
sub eax, 3
jb 0x41f8f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f962
mov ebp, eax
add ebx, ebx
jne 0x41f8fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f92c
inc ecx
add ebx, ebx
jne 0x41f918
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f90d
jne 0x41f929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f90d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f94c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f93d
jmp 0x41f8ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f94c
add edi, ecx
jmp 0x41f8ae
pop esi
mov edi, esi
mov ecx, 0x3dd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f96a
cmp byte [edi], 7
jne 0x41f96a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f96f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f9de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f3a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f3f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f99c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f3f4]
or eax, eax
je 0x41f9d8
mov dword [ebx], eax
add ebx, 4
jmp 0x41f9b9
call dword [esi + 0x1f3f8]
popal
jmp section.UPX0
Function at 0x1a0002
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1b3277
sub esp, 0x24
mov eax, dword [0x213038]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
xor ebx, ebx
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1b32e5
mov eax, dword [edi]
lea ecx, [esp + 0x18]
add eax, esi
push eax
call fcn.001a066a
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.001a22df
pop ecx
pop ecx
test al, al
jne 0x1b32fc
lea ecx, [esp + 0x18]
add edi, 4
call fcn.001a2276
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x1b32b0
xor esi, esi
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.001a186c
add esp, 0x24
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + esi]
lea ecx, [esp + 0x18]
call fcn.001a2276
jmp 0x1b32e7

Function at 0x1a243d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1b399d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x1b3a91
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x215728
mov bl, byte [esi + edi]
push 0x1fa3d8
push ebp
call fcn.001a1588
xor edx, edx
mov eax, esi
div dword [esp + 0x24]
pop ecx
pop ecx
push 0x15d1a9
push 0x1fa3e4
mov bh, byte [edx + section..REMO]
push 0x215810
xor bh, bl
call fcn.001a1588
pop ecx
pop ecx
mov ecx, eax
call fcn.001a3f27
mov bl, byte [esi + edi]
push 0x15d1a9
push 0x1fa3f4
push ebp
call fcn.001a1588
pop ecx
pop ecx
mov ecx, eax
call fcn.001a3f27
add byte [esi + edi], bh
push 0x15d1a9
push 0x1fa408
push ebp
call fcn.001a1588
pop ecx
pop ecx
mov ecx, eax
call fcn.001a3f27
dec byte [esi + edi]
push 0x1fa428
push ebp
call fcn.001a1588
add byte [esi + edi], 0xfe
push 0x1fa434
push ebp
call fcn.001a1588
sub byte [esi + edi], bl
push 0x1fa448
push ebp
call fcn.001a1588
inc byte [esi + edi]
push 0x1fa458
push ebp
call fcn.001a1588
inc byte [esi + edi]
push 0x1fa464
push ebp
call fcn.001a1588
inc byte [esi + edi]
push 0x1fa470
push ebp
call fcn.001a1588
add esp, 0x30
inc esi
cmp esi, dword [esp + 0x18]
jb 0x1b39b6
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x1a4012
Capabilities:
Parse pe header

Disassembly:
jmp 0x1d82f1
push 0
call dword [0x2180e0]
test eax, eax
je 0x1d8330
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1d8330
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1d8330
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1d8330
cmp dword [ecx + 0x74], 0xe
jbe 0x1d8330
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1a42b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1b3342
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x251f88], eax
pop edi
pop esi
ret
Function at 0x7acef0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7acefa
pushal
call 0x7acf00
pop ebp
sub ebp, 0x10
sub ebp, 0x3acef0
jmp 0x7acf16
mov eax, 0x3acef0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0x2b82fef5
xor byte [eax], dl
inc eax
dec ecx
jne 0x7acf2d
jmp 0x7acf40
jle 0x7acf7a
jle 0x7acfc0
leave
cmc
cmc
cmc
je 0x7acf7e
or eax, 0xf6f5f5f5
cmp byte [ebp - 0xf], cl
cmc
cmc
cmc
dec edi
invalid
rcr dword [ebp - 0x75ecb1b0], 1
sbb eax, 0xf5f5f5f0
adc ecx, dword [edx - 0xa0a0fe3]
cmc
sbb al, 0xdd
cmc
cmc
cmc
mov al, byte [0x707e197e]
std
cmc
cmc
cmc
jle 0x7acff5
stc
cmc
cmc
cmc
jle 0x7ad013
in eax, 0xf5
cmc
cmc
xor al, 0x1c
test esp, 0xf13776f7
mov esp, 0xa0170fa
or cl, byte [edx]
test al, 0x37
stc
cmc
jle 0x7ad02d
sal ecx, 1
cmc
cmc
cmc
popfd
jge 0x7acf45
sti
cmc
popfd
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
fprem1
hlt
invalid
invalid
cmc
cmc
cmc
cli
jge 0x7acfc1
cmc
cmc
cmc
xchg ebx, eax
jle 0x7acff3
int3
cmc
jne 0x7ad024
sbb al, 0xfa
jno 0x7acffe
cmc
cmc
cmc
xchg ebx, eax
je 0x7ad02e
or dl, al
cli
jno 0x7ad005
loopne 0x7ad01b
cmc
cmc
cmc
mov ah, 0x1c
cmp dword [edx], ecx
or cl, byte [edx]
or bl, ah
mov ecx, 0x3476f4cc
fdivr qword [ecx + 0x3476f4cc]
invalid

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebp, ebp
pop ecx
test eax, eax
je 0x401079
push str.Windows_original_main_args:_n
call fcn.004010ff
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebp
pop ecx
call edi
cmp dword [eax], ebp
jle 0x401079
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010ff
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401059
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebp
test ebx, ebx
jle 0x4010b7
mov edi, esi
mov ecx, dword [eax + edx*8]
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jl 0x4010aa
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebp
test ecx, ecx
jne 0x4010c6
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010d1
mov eax, dword [esi]
push ebp
push ebp
push ebp
push 1
push ecx
push eax
push 0x4021cc
push 0x4021d0
push 0x40300c
push 2
push 0x403004
push 2
push esi
push ebx
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x401810
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40184f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40184f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40184f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40184f
cmp dword [ecx + 0x74], 0xe
jbe 0x40184f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4095f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423d88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42c520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x462f88
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.00409a90
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x4096f6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004097d0
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x4096e9
test ebx, ebx
je 0x4096f4
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.__s_
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406f60
mov edi, dword [ebp - 0x14]
mov eax, edi
add esp, 8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4096a0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
lea eax, [edi - 0x10]
inc esi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x4096f4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40973c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40529d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
movzx esi, word [esp + 0x14]
push 2
push esi
call sub.MFC42u.DLL_AfxFindResourceHandle
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
push 2
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
jne 0x4052d0
xor ebp, ebp
push 2
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x4052f4
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4052f4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4052f4
push eax
call fcn.0040526a
cmp ax, 0x10
pop ecx
je 0x4052f8
xor eax, eax
jmp 0x405301
push 0
push edi
push ebp
call sub.MFC42u.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4054d3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push esi
xor esi, esi
cmp dword [0x41b620], esi
je 0x4054f1
mov eax, dword [0x41b61c]
jmp 0x40559e
push ebx
push 1
pop ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftPlus_ThemesCurrent
push SysReAllocStringLen
mov dword [0x41b620], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405598
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
mov dword [ebp - 0xc], 0x104
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40558e
push 0xb
mov esi, 0x41b048
pop ecx
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x254]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x38]
push eax
call esi
cmp edi, eax
jl 0x40558e
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x38]
push eax
call esi
sub edi, eax
lea eax, [ebp + edi*2 - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40558e
mov dword [0x41b61c], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [0x41b61c]
pop ebx
pop esi
leave
ret

Function at 0x40726e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004065c5
aaa
xchg esi, eax
and al, 0xcf
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4072b9
cmp dword [ebp - 0x398], 0
invalid
test ah, dl
add dword [eax], eax
Function at 0x4079b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00406536
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x4079d2
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x407a1b
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4079c5
call fcn.004065c5
or dl, al
cmp cl, al
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
invalid
test ecx, esp
clc
invalid
invalid

Function at 0x40cbc6
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [ecx + 0x40]
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.MFC42u.DLL_CWnd::FromHandle
test eax, eax
je 0x40cbe0
mov eax, dword [eax + 0x20]
push 5
push 0
push 0
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
pop esi
ret