joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fe90
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
sub esp, 0x20
push ebx
push edi
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
cmp dword [0x10046ef8], 1
jne 0x1000fec0
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x2c], 0
mov ecx, dword [esi + 0x1740]
push 0
je 0x1000ff4a
push 0x32
push 0x32
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 0x1800]
mov eax, dword [edx + 0x48]
lea ecx, [esi + 0x1800]
push 1
push 0x10036204
call eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esi + 0x1818], eax
jmp 0x1000ff65
push 0x1a0
push 0x27a
push 0x113
push 0x1a5
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [esi + 0x1938], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x49
je 0x1000ff80
mov edi, 0x4b
jmp 0x1000ff91
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 0
mov ecx, esi
call eax
push eax
call ebx
xor ecx, ecx
cmp dword [0x10046ef8], 1
jne 0x1000ff9f
or ecx, 0xffffffff
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
push edi
add eax, dword [esp + 0x28]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
add eax, dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x8c]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 1
mov ecx, esi
call eax
push eax
call ebx
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x10014180
Capabilities:
Accept command line arguments
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002f0d9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1004304c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x1004304c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0
push str._ShowDeskTop
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp eax, dword [ecx]
lea ecx, [esp + 8]
setne bl
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x2c
ret

Function at 0x10014c30
Capabilities:
Create process on windows

Disassembly:
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push esi
push 0x10036b10
push 0
call edi
cmp eax, 0x20
jg 0x10014c65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0
push esi
push str.iexplore
push 0x10036b10
push 0
call edi
pop edi
ret
Function at 0x10019260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
movzx esi, dx
push 0x10036d9c
mov edi, eax
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
jne 0x100192b5
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10019362
push 0x2000
push ebp
push ebp
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebx + 4], eax
xor eax, eax
mov esi, ebx
call fcn.10018c80
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100192d0
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
push ebp
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push esi
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x10]
push eax
push 1
xor esi, esi
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1001935b
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1001935b
push eax
push ebx
call fcn.10018890
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
xor edi, edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
call fcn.10019170
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x10021f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x51c
mov eax, dword [0x1004304c]
xor eax, esp
mov dword [esp + 0x518], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], edi
cmp edi, ebx
jne 0x10021f6b
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
push esi
push 0x3ff
lea eax, [esp + 0x129]
push ebx
push eax
mov byte [esp + 0x130], bl
call sub.MSVCR90.dll_memset
push 0xfe
lea edx, [esp + 0x36]
xor ecx, ecx
push ebx
mov esi, 0x400
push edx
mov dword [esp + 0x28], esi
mov word [esp + 0x3c], cx
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x3c]
add esp, 0x18
lea ecx, [edi + 8]
test eax, eax
je 0x10021fde
cmp ecx, ebx
je 0x10021fde
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10021fc0
sub eax, esi
inc eax
push eax
lea edx, [esp + 0x28]
push edx
push eax
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push 0xffffffffffffffff
shr esi, 1
push esi
mov esi, dword [sym.imp.MSVCR90.dll__snwprintf_s]
lea ecx, [esp + 0x134]
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x130]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10022040
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
push 0x400
lea ecx, [esp + 0x128]
push ebx
push ecx
mov dword [esp + 0x20], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.PnpInstanceID
push edx
call edi
test eax, eax
jne 0x10022138
lea ecx, [esp + 0x124]
push ecx
push 0x10037390
push 0xffffffffffffffff
lea edx, [esp + 0x28]
push 4
push edx
mov word [esp + 0x30], ax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
call esi
lea eax, [esp + 0x30]
push 4
push eax
call dword [sym.imp.MSVCR90.dll__wcslwr_s]
lea ecx, [esp + 0x38]
push 0x10037398
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 0x24
test eax, eax
jne 0x10022138
call fcn.10021ed0
test al, al
je 0x100220e7
mov edx, dword [esp + 0x18]
cmp dword [edx + 0x1a0], 6
jmp 0x10022134
push 0x400
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push str.MediaSubType
push ecx
mov dword [esp + 0x28], 0x400
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x10022138
cmp dword [esp + 0x124], 1
jne 0x10022138
mov bl, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x524]
pop esi
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xbb9984
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xbb998a
pop ebp
sub ebp, 6
sub ebp, 0x7b9984
jmp 0xbb99e8
mov al, byte [esp + 0x28]
cmp al, 1
je 0xbb99ff
popal
xor eax, eax
inc eax
ret 0xc
jmp 0xbb9a08
mov eax, 0x7b9984
add eax, ebp
add eax, 0xaa
mov ecx, 0x5ba
mov edx, 0x55576a49
xor byte [eax], dl
inc eax
dec ecx
jne 0xbb9a1f
jmp 0xbb9a32
ret 0xc284
Function at 0x402f0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov byte [ebp - 0x52e], 0xb9
mov byte [ebp - 0x52d], 0xa5
mov byte [ebp - 0x52c], 0xb3
mov byte [ebp - 0x52b], 0x9e
mov byte [ebp - 0x52a], 0xb7
mov byte [ebp - 0x529], 0xb8
mov byte [ebp - 0x528], 0xb2
mov byte [ebp - 0x527], 0xba
mov byte [ebp - 0x526], 0xb3
mov byte [ebp - 0x525], 0xd6
lea eax, [ebp - 0x534]
push eax
call fcn.0040399d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403952
add esp, 0xc
mov dword [ebp - 0x680], eax
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 0xfc
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0x4b
mov byte [ebp - 0x65f], 0x66
mov byte [ebp - 0x65e], 0x62
mov byte [ebp - 0x65d], 0x73
mov byte [ebp - 0x65c], 0x42
mov byte [ebp - 0x65b], 0x6f
mov byte [ebp - 0x65a], 0x6f
mov byte [ebp - 0x659], 0x6c
mov byte [ebp - 0x658], 0x60
mov byte [ebp - 0x657], 3
lea eax, [ebp - 0x664]
push eax
call fcn.0040399d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403952
add esp, 0xc
mov dword [ebp - 0x67c], eax
call fcn.0040398d
ret

Function at 0x403bf5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc esi, eax
inc ebp
mov dl, 0x16
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0xf
mov byte [ebp - 0x4b], 0x2b
mov byte [ebp - 0x4a], 0xc
mov byte [ebp - 0x49], 4
mov byte [ebp - 0x48], 0xd
mov byte [ebp - 0x47], 0x62
call fcn.0040398d
adc byte [ebx], cl
mov dword [0xa8458d44], eax
push eax
call fcn.0040399d
mov edi, dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.00403952
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x403c65
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x30]
mov dword [ebp + 0xc], ecx
push eax
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x6a
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 0xc3
mov byte [ebp - 0x2b], 0xfc
mov byte [ebp - 0x2a], 0xe7
Function at 0x4040d1
Capabilities:
Inspect section memory permissions

Disassembly:
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x404070
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x404098
call fcn.0040398d
cmp byte [ebx], dh
inc edi
wait
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x4040ee
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4040d7
or byte [eax + ecx], 1
cmp edi, ebx
je 0x4040df
or byte [eax + ecx], 2
cmp esi, ebx
je 0x4040e8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x4040cc
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x404051
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40413b
dec eax
je 0x404132
sub eax, 3
je 0x404129
mov dword [ebp - 4], 0x40
jmp 0x40413e
mov dword [ebp - 4], 4
jmp 0x40413e
mov dword [ebp - 4], 0x20
jmp 0x40413e
mov dword [ebp - 4], ecx
call fcn.0040398d
dec ebp
dec eax
or al, 0x44
cmp dword [ebp - 4], 0x40
je 0x404165
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esi
call dword [ebp - 0xc4]
test eax, eax
je 0x404198
add esi, dword [ebp - 0xac]
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40410a
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
add esi, dword [ebp + 0xc]
call fcn.0040398d
cld
sbb al, 0x4b
mov al, byte [0x6a1475ff]
add edi, edi
jne 0x40419d
call esi
mov eax, dword [ebp + 0xc]
jmp 0x4041a6
push 0x8000
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40534b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 0xd2
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0x6e
outsb dx, byte [esi]
mov byte [ebp - 0x777], 0x17
mov byte [ebp - 0x776], 0x71
mov byte [ebp - 0x775], 0x7d
mov byte [ebp - 0x774], 0x5f
mov byte [ebp - 0x773], 0x42
mov byte [ebp - 0x772], 0x4a
mov byte [ebp - 0x771], 0x5f
mov byte [ebp - 0x770], 0x4c
mov byte [ebp - 0x76f], 0x40
mov byte [ebp - 0x76e], 0xd
mov byte [ebp - 0x76d], 0x6b
mov byte [ebp - 0x76c], 0x44
mov byte [ebp - 0x76b], 0x41
mov byte [ebp - 0x76a], 0x48

Function at 0x4053c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x405a2d
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x4054f9
and byte [ebp - 0x77c], 0
mov byte [ebp - 0x769], 0x5e
mov byte [ebp - 0x768], 0x71
mov byte [ebp - 0x767], 0x6e
mov byte [ebp - 0x766], 0x42
mov byte [ebp - 0x765], 0x40
mov byte [ebp - 0x764], 0x40
mov byte [ebp - 0x763], 0x42
mov byte [ebp - 0x762], 0x43
mov byte [ebp - 0x761], 0xd
Function at 0x405408
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x760], 0x6b
mov byte [ebp - 0x75f], 0x44
mov byte [ebp - 0x75e], 0x41
mov byte [ebp - 0x75d], 0x48
mov byte [ebp - 0x75c], 0x5e
mov byte [ebp - 0x75b], 0x71
mov byte [ebp - 0x75a], 0x7e
mov byte [ebp - 0x759], 0x54
mov byte [ebp - 0x758], 0x5e
mov byte [ebp - 0x757], 0x59
mov byte [ebp - 0x756], 0x48
mov byte [ebp - 0x755], 0x40
mov byte [ebp - 0x754], 0x71
mov byte [ebp - 0x753], 0x5e
mov byte [ebp - 0x752], 0x54
mov byte [ebp - 0x751], 0x40
mov byte [ebp - 0x750], 0x5e
mov byte [ebp - 0x74f], 0x5f
mov byte [ebp - 0x74e], 0x5b
mov byte [ebp - 0x74d], 3
mov byte [ebp - 0x74c], 0x49
mov byte [ebp - 0x74b], 0x41
mov byte [ebp - 0x74a], 0x41
mov byte [ebp - 0x749], 0x2d
lea eax, [ebp - 0x77c]
push eax
call fcn.0040399d
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.0040399d
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
invalid
invalid
Function at 0x402788
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402796
call dword [0x4c301c]
or eax, eax
je 0x402797
ret
mov al, 1
jmp fcn.00402860

Function at 0x4027a0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027ae
call dword [0x4c3020]
or eax, eax
jne 0x4027af
ret
mov al, 2
jmp fcn.00402860

Function at 0x4027b8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027f0
test edx, edx
je 0x4027da
push eax
mov eax, ecx
call dword [0x4c3024]
pop ecx
or eax, eax
je 0x4027e9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402860
mov dword [eax], edx
mov eax, ecx
call dword [0x4c3020]
or eax, eax
jne 0x4027d3
ret
mov al, 1
jmp fcn.00402860
test edx, edx
je 0x402804
push eax
mov eax, edx
call dword [0x4c301c]
pop ecx
or eax, eax
je 0x4027e9
mov dword [ecx], eax
ret

Function at 0x402860
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x4c6004]
test ecx, ecx
je 0x402870
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402889]
jns 0x402884
call fcn.00406cb4
mov eax, dword [eax + 4]
jmp fcn.00403ca8

Function at 0x4028a4
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00406cb4
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4028b9
ret
xor eax, eax
jmp fcn.00402860

Function at 0x402a14
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a43
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d98
jmp 0x402a61
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040299c
mov edi, eax
test ebx, ebx
je 0x402a61
cmp dword [esi], 0
je 0x402a61
dec ebx
jmp 0x402a4a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402fd0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fb0
xor eax, eax
push ebp
push 0x402fa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402fec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fb0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403250
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40326a
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x40326a
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x403256
mov al, 0xa
jmp fcn.00402860
ret
Function at 0x40329c
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4c601c], 0
je 0x402b3b
call dword [0x4c601c]
mov eax, 0xd2
jmp fcn.00403ca8
push eax
push ecx
mov eax, dword [eax]
call fcn.0040326c
pop ecx
pop eax
je 0x4032ab
jmp ebx
pop ecx
jmp 0x402b2c

Function at 0x4032b4
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.0040326c
mov eax, ebx
pop ebx
jne 0x4032c9
pop ecx
jmp 0x402b2c
ret

Function at 0x403b84
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4c64a4
mov esi, 0x4c6038
mov edi, 0x4c603c
cmp byte [ebx + 0x24], 0
jne 0x403bb3
cmp dword [edi], 0
je 0x403bb3
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403ba2
cmp dword [0x4c6040], 0
je 0x403bfa
call fcn.00403b00
cmp byte [0x4c6048], 0
je 0x403be0
mov edx, 0x4c302c
mov eax, 0x4c621c
call fcn.00406550
call fcn.004064d3
jmp 0x403bf3
push 0
push 0x4c304c
push 0x4c302c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x4c6040], eax
cmp byte [ebx + 0x24], 2
jne 0x403c0a
cmp dword [esi], 0
jne 0x403c0a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004039d4
cmp byte [ebx + 0x24], 1
jbe 0x403c1a
cmp dword [esi], 0
je 0x403c37
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403c37
call fcn.00405f28
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403c37
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.004039ac
cmp byte [ebx + 0x24], 1
jne 0x403c45
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403c50
call fcn.00403b50
cmp dword [ebx], 0
jne 0x403c5d
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403bfa

Function at 0x404340
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404304
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404304
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4042ec
ret

Function at 0x4043e8
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402860
test ecx, ecx
je fcn.00404304
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4042ec
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret