joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a5a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
jmp 0x43a5ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43a5c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43a5b0
mov eax, 1
add ebx, ebx
jne 0x43a5d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43a5c8
jne 0x43a5e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a5c8
xor ecx, ecx
sub eax, 3
jb 0x43a5f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43a66a
mov ebp, eax
add ebx, ebx
jne 0x43a603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43a610
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43a634
inc ecx
add ebx, ebx
jne 0x43a620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43a615
jne 0x43a631
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a615
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43a654
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43a645
jmp 0x43a5b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43a654
add edi, ecx
jmp 0x43a5b6
pop esi
mov edi, esi
mov ecx, 0xe6e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43a672
cmp byte [edi], 0x17
jne 0x43a672
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43a677
lea edi, [esi + 0x38000]
mov eax, dword [edi]
or eax, eax
je 0x43a6ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e064]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e17c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43a6a4
mov ecx, edi
jns 0x43a6d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e180]
or eax, eax
je 0x43a6e9
mov dword [ebx], eax
add ebx, 4
jmp 0x43a6c1
call dword [esi + 0x3e190]
mov ebp, dword [esi + 0x3e184]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43a723
sub esp, 0xffffff80
jmp 0x413486
Function at 0x644723
Capabilities:
Encrypt data using aes

Disassembly:
xchg byte [esp + 6], bl
mov eax, dword [eax*4 + 0x628740]
bswap edi
mov di, ax
jmp 0x6446e0

Function at 0x646bdb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 3]
call fcn.00646bfe
mov byte [esp], dh
jmp 0x646bb9

Function at 0x646bfe
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.00648698
repe cmpsb byte [esi], byte es:[edi]
jmp 0x625b0d
push 0x2cf02761
call fcn.0062c9c3
push 0x2cf056b4
call fcn.0062c9c3
lea ecx, [eax - 1]
mov di, word [esp]
jmp 0x646c3e
lea esp, [esp + 1]
lea esp, [esp + 4]
jle 0x61f7af
jg 0x646bc2
adc dword [ecx - 0x6c9fff], edx
xchg ecx, eax
adc al, byte [eax + 0x130712e7]
mov cl, byte [ecx + 0xc89242c]
and al, 0xe8
retf
push eax
mov eax, ebp
lea eax, [eax - 4]
jmp fcn.00646c27

Function at 0x64738e
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 2], bx
jmp 0x6473e1
cmc
push word [esp + 9]
mov dword [esp + 9], ebp
jmp 0x6473f5
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x628f40]
movzx ebx, byte [esi + 5]
sub esp, 0xe
jmp 0x6473c8
and edx, ecx
sub esp, 8
jmp 0x647448
and edx, ecx
sub esp, 2
lea esp, [esp + 2]
jmp 0x647414
mov edx, dword [edx*4 + 0x628740]
jmp 0x647431

Function at 0x647484
Capabilities:
Encrypt data using aes

Disassembly:
add di, 0xc056
mov ebx, dword [ebx*4 + 0x628740]
bsf di, ax
bsr di, cx
jmp 0x647937
lea esp, [esp + 1]
shr edi, 0x18
sub esp, 4
call fcn.006478cd
lea ebx, [ebx*4]
lea ebx, [ebx + 0x628740]
mov edi, dword [ebx]
pop ebx
jmp 0x647cb8
mov edi, edx
cmc
sub esp, 2
lea esp, [esp + 1]
mov byte [esp], ah
jmp 0x6478f4
lea esp, [esp + 0x17]
mov dword [esp + 1], esi
pop word [esp + 2]
lea esp, [esp + 3]
and ebx, ecx
call fcn.00647c58
or byte [eax - 0x6f7786e2], cl
cmpsb byte [esi], byte es:[edi]
and eax, 0x4f2fdcb5
aam 0x47
out dx, al
stc
fdivr dword [ebx]
lea eax, [eax*4]
lea eax, [eax + 0x628b40]
mov edi, dword [eax]
pop eax
pushal
jmp 0x647b54
and edi, ecx
push eax
mov eax, edi
jmp 0x647b7e

Function at 0x6478cd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 3
lea esp, [esp + 1]
jmp 0x6478da
push ebx
pushal
lea eax, [edx + ebp]
mov dword [esp + 0x10], edi
jmp 0x64791e
sub esp, 0x12
add esp, 1
lea esp, [esp + 1]
lea esp, [esp + 0x10]
popal
jmp 0x647903

Function at 0x647fcc
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x628740]
sub esp, 0x14
push esp
mov dword [esp + 9], ecx
jmp 0x647fdb
mov word [esp], dx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x647faf
and edx, ecx
lea esp, [esp + 0x3c]
xor edi, dword [edx*4 + 0x629740]
jmp 0x64801b
mov edx, dword [esi + 0xc]
sub esp, 6
lea esp, [esp + 2]
mov dword [esi + 8], edi
jmp 0x64807b
pushal
lea ebp, [esp + ecx]
lea edi, [ecx*4]
mov ebx, dword [ebx*4 + 0x628740]
stc
bswap edi
jmp 0x648063
Function at 0x6482f2
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebp
and ebx, ecx
call 0x6482f2
out dx, eax
sub esp, 0xc
jmp 0x6482fb
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x648388
and edx, ecx
push esp
mov edx, dword [edx*4 + 0x628740]
sub esp, 6
jmp 0x648332
mov ebx, dword [ebx*4 + 0x628740]
cmc
jmp 0x64834b
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + 0x629340]
movzx ebx, byte [esi + 0xe]
jmp 0x64836b

Function at 0x6483e3
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x6483ea
push word [esp + 3]
jmp 0x6483cc
and edx, ecx
clc
sub esp, 0xe
mov dword [esp + 5], esi
lea esp, [esp + 2]
jmp 0x648688
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x629740]
call fcn.0064863b

Function at 0x64860d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esp
push word [esp + 7]
pushal
lea esp, [esp + 2]
jmp 0x64865f
mov dword [esi + 0xc], edi
push edx
mov word [esp], di
call fcn.00648644
jne 0x61f778
je 0x61f7af
std
jmp dword [0xa35031a1]
and eax, 0xa35031a1
cdq
loop 0x6486f1
pop ss
loop 0x648676
mov dword [0x8d2435da], eax
and al, 0x10
cmp ch, byte [eax - 0x62d5c531]
pop ds
invalid

Function at 0x64863b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
dec ebx
mov esp, 0x6e8f5320
push eax
aad 0xb1
ret 0xc765
dec dword [ebp - 4]
call fcn.0064860d
popfd
push ss
test bl, ah
push ds
cdq
pop es
mov ebx, dword [ebx]
jle 0x6485c4
in eax, 0xae
mov ecx, 0x2434ff98
push dword [esp]
push dword [esp]
lea esp, [esp + 8]
jmp 0x648624

Function at 0x12742e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
mov dx, 0xaeef
mov si, bx
neg bh
mov dl, 0x2c
sub bl, ah
jmp 0x12742c4
xchg word [esp + 0x23], ax
neg dh
setl ch
not ah
mov cl, 0x8a
add esp, 7
jmp 0x127425c
add al, dh
mov ah, byte [esp + 0x21]
not dx
rdtsc
xor bx, 0x7834
rol dx, cl
jmp 0x127427b
lea ecx, [esi*4]
lea ebx, [ecx + 0xfb]
mov byte [esp + 3], ah
jmp 0x1274344
mov dl, 0x74
mov di, word [esp]
lea esi, [edi*4]
sub esp, 8
lea ebx, [ecx + edi]
xchg word [esp + 1], si
jmp 0x12742aa
rdtsc
lea ecx, [ebp*4]
pop dword [esp + 6]
rdtsc
jmp 0x1274295
xchg dword [esp + 2], esi
mov dword [esp + 3], ebp
sub esp, 4
mov al, 0x1e
btr ebp, esp
call fcn.01274388
pop ebx
neg ch
mov ch, byte [esp + 6]
neg si
mov ax, bx
neg di
mov byte [esp + 7], ch
jmp 0x12742f9
mov esi, eax
xchg byte [esp], al
lea ebx, [ecx + edx]
rdtsc
mov dl, dh
mov byte [esp + 3], ah
jmp 0x127430f
lea ebp, [ebp*4]
mov bl, 0x28
xchg dword [esp + 4], edx
lea ecx, [ebp - 0xa7]
mov bp, 0x659b
xchg ebx, ebp
jmp 0x127432c
Function at 0x127545d
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
lea esp, [esp + 3]
mov word [esp], dx
jmp 0x12754b0
mov word [esp], di
mov byte [esp + 1], bh
mov word [esp], di
mov word [esp], di
mov word [esp], bx
call fcn.01275496
jmp 0x127550c
push dword [esp + 2]
push word [esp + 5]
call fcn.012754cb

Function at 0x1275496
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 2], di
jmp 0x12754fc
lea esp, [esp + 3]
mov dword [esp + 0x84], esi
call fcn.012754e2

Function at 0x12754c9
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
lea esp, [esp + 3]
mov word [esp], dx
jmp 0x12754b0
mov word [esp], di
mov byte [esp + 1], bh
mov word [esp], di
mov word [esp], di
mov word [esp], bx
call fcn.01275496
jmp 0x127550c
push dword [esp + 2]
push word [esp + 5]
call fcn.012754cb

Function at 0x127551a
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.01275077
lea esp, [esp + 3]
lea esp, [esp + 3]
mov dword [esp + 0x8c], edi
jmp 0x127582f
push eax
jmp 0x1275072
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x1275720
lea esp, [esp + 0x8c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x12757f9

Function at 0x127660f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ecx + 0x4b]
mov byte [esp + 6], bh
lea esp, [esp + 5]
lea eax, [ecx - 0xfb]
bsf si, si
cpuid
jmp 0x1274fef
xchg ebp, esi
sete ch
mov ebx, ebp
bswap ebp
ror ebx, 0x1d
pop ebx
jmp 0x1275005
lea eax, [esi*4]
rdtsc
mov edx, eax
mov cl, 0xa2
add al, dh
pop dword [esp + 1]
jmp 0x127501d
bswap ecx
lea eax, [ebp - 0xe705f61]
pop dword [esp + 1]
rcl di, cl
inc cx
rdtsc
jmp 0x1275044
mov cx, sp
mov bl, bh
mov cl, 0x72
xchg byte [esp + 0xe], dl
mov byte [esp + 0x13], ah
xor si, 0x5cc4
jmp 0x12751c4
mov byte [esp + 3], ah
mov ebp, 0x51cb052e
sub bl, ah
xchg edi, ecx
rdtsc
neg bh
jmp 0x1275537
xchg edi, edx
mov word [esp + 3], bx
mov dx, word [esp + 0x13]
not eax
rdtsc
xchg byte [esp + 6], dl
jmp 0x1275bd7
rdtsc
mov dl, dh
push dword [esp + 0x12]
jmp 0x1275d59
Function at 0x401170
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x44d5b8
push 0x411044
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x450028]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x21c], 0x30
push 0x1fc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00411068
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x21c]
push ecx
push 0x414590
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x401253
mov dword [ebp - 0x220], ebx
lea edx, [ebp - 0x220]
push edx
push 0x4145c0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR80.dll_swscanf_s]
add esp, 0xc
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0x5c44], bl
je 0x40124c
cmp byte [eax + 0x5c45], bl
jne 0x40124c
cmp dword [eax + 0x5c60], 0x5e640
jne 0x40124c
mov dword [ebp - 4], 0xfffffffe
jmp 0x401258
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x450220
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret

Function at 0x401280
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1fc
lea eax, [ebp - 0x200]
push 0
push eax
mov dword [ebp - 0x204], 0x30
call fcn.00411068
push 0x450220
lea ecx, [ebp - 0x204]
push 0x4145c0
push ecx
or edx, 0xffffffff
call fcn.00406410
add esp, 0x18
lea edx, [ebp - 0x204]
push edx
push 0x414590
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, esi
call fcn.00401300
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
Function at 0x401300
Capabilities:
Accept command line arguments

Disassembly:
push edi
push 0x455e68
mov edi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x455e64], 0
je 0x401329
push 0x455e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x810a0001
pop edi
ret
test edi, edi
mov byte [0x455e64], 1
mov dword [0x450224], 0
jne 0x401343
mov edi, 0x415a60
push 0x104
push 0x455a5c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x455a5c
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x40137b
push 0x455e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x810a0002
pop edi
ret
mov ecx, eax
push esi
mov esi, dword [sym.imp.MSVCR80.dll_wcsncpy_s]
sub ecx, 0x450220
sub ecx, 0x583c
push 0xffffffffffffffff
sar ecx, 1
mov edx, 0x104
push 0x4145c8
sub edx, ecx
push edx
push eax
call esi
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xffffffffffffffff
push eax
push 0x1000
push 0x45050c
call esi
push 0xffffffffffffffff
push 0x414528
push 0x40
push 0x45595c
call esi
push 0xffffffffffffffff
push edi
push 0x40
push 0x4559dc
call esi
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4145e8
push 0x455c64
or edx, 0xffffffff
call fcn.00406410
add esp, 0xc
push 0x4015e0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp eax, 0x4015e0
mov dword [0x450220], eax
pop esi
jne 0x401419
mov dword [0x450220], 0
push 0x4014b0
call dword [sym.imp.MSVCR80.dll__set_invalid_parameter_handler]
push 0x401560
call dword [sym.imp.MSVCR80.dll__set_purecall_handler]
add esp, 8
push 0x455e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
ret
Function at 0x401930
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push 0
push 4
call fcn.00410566
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x4019e9
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x1c
call fcn.0041056c
test eax, eax
jne 0x401987
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
push esi
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x10], eax
jne 0x4019d4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x4019d4
push ecx
push 0
push 0x1f03ff
call edi
mov esi, eax
test esi, esi
je 0x4019f0
cmp dword [ebp + 8], 0
push esi
je 0x4019c7
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4019cd
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
push ecx
push ebx
call fcn.00410572
test eax, eax
jne 0x401990
pop esi
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401fa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411a09
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x456360], 0
jbe 0x401ff5
cmp dword [0x456364], 8
mov eax, dword [0x456350]
jae 0x401fe5
mov eax, 0x456350
push 0xffffffffffffffff
push eax
push ebx
push esi
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
jmp 0x402042
lea edi, [ebp - 0x2c]
call fcn.00401e20
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x402009
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
push 0x415a60
push 0x414544
push 0x41455c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
jne 0x40203c
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 0x80004005
jmp 0x402044
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
Function at 0x402060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41177c
mov eax, dword fs:[0]
push eax
mov eax, 0x2080
call fcn.00411690
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x202c]
mov edi, ecx
call fcn.00401da0
push 0x414c74
mov ecx, esi
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov esi, 8
cmp dword [edi + 0x18], esi
jb 0x4020c1
mov edi, dword [edi + 4]
jmp 0x4020c4
add edi, 4
cmp dword [ebp - 0x2014], esi
mov eax, dword [ebp - 0x2028]
jae 0x4020d8
lea eax, [ebp - 0x2028]
push edi
push eax
push 0x414c90
lea edx, [ebp - 0x2010]
call fcn.004064b0
push 0x44
lea eax, [ebp - 0x2088]
push 0
push eax
call fcn.00411068
xor eax, eax
add esp, 0x18
cmp dword [ebp - 0x2014], esi
mov dword [ebp - 0x203c], eax
mov dword [ebp - 0x2038], eax
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x2030], eax
mov eax, dword [ebp - 0x2028]
mov dword [ebp - 0x2088], 0x44
jae 0x402135
lea eax, [ebp - 0x2028]
lea ecx, [ebp - 0x203c]
push ecx
lea edx, [ebp - 0x2088]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40218e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x402175
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x202c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
jmp 0x4021c8
mov edx, dword [ebp - 0x2034]
push edx
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov eax, dword [ebp - 0x2038]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x203c]
push ecx
call esi
lea ecx, [ebp - 0x202c]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
Function at 0x4021f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 8
mov esi, 0x414ca0
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
xor edi, edi
lea eax, [ebp - 0x1e4]
push edi
push eax
call fcn.00411068
lea eax, [ebp - 0x204]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x402240
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402240
sub eax, edx
sar eax, 1
mov ebx, 0x100
sub ebx, eax
lea esi, [ebp + eax*2 - 0x204]
call fcn.00401fa0
lea ecx, [ebp - 0x208]
push ecx
push 1
push edi
lea edx, [ebp - 0x204]
push edx
push 0x80000001
mov dword [ebp - 0x208], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x208]
cmp eax, edi
je 0x4022cf
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
push edi
push edi
push 0x414cc0
push eax
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x210], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x20c], edi
jne 0x4022e2
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor edx, edx
cmp edx, dword [ebp - 0x20c]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.00410b3e
mov esp, ebp
pop ebp
ret

Function at 0x402310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 8
mov esi, 0x414ca0
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
xor edi, edi
lea eax, [ebp - 0x1e4]
push edi
push eax
call fcn.00411068
lea eax, [ebp - 0x204]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x402360
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402360
sub eax, edx
sar eax, 1
mov ebx, 0x100
sub ebx, eax
lea esi, [ebp + eax*2 - 0x204]
call fcn.00401fa0
lea ecx, [ebp - 0x208]
push ecx
push 1
push edi
lea edx, [ebp - 0x204]
push edx
push 0x80000001
mov dword [ebp - 0x208], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x208]
cmp eax, edi
je 0x4023ef
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
push edi
push edi
push 0x414ce4
push eax
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x210], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x20c], edi
jne 0x402402
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor edx, edx
cmp edx, dword [ebp - 0x20c]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
Function at 0x402430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x450028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004021f0
test eax, eax
jne 0x402481
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410b3e
mov esp, ebp
pop ebp
ret
push 0x414d04
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp dword [ebp + 8], 0
mov dword [ebp - 4], 0
mov esi, 0x414d2c
jne 0x4024a6
mov esi, 0x414d38
push 0x414d44
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push esi
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [0x41317c]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x2c]
call fcn.00402060
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]