joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
or esi, esi
je 0x40c9f8
mov dword [ebp - 0x40], esi
push esi
call sub.CRTDLL.dll_strlen
pop ecx
lea edi, [eax + esi - 1]
jmp 0x40c94a
dec edi
cmp edi, esi
jbe 0x40c953
cmp byte [edi], 0x5c
jne 0x40c949
cmp edi, esi
jbe 0x40c989
mov byte [edi], 0
push esi
lea eax, [ebp - 0x240]
push eax
call sub.CRTDLL.dll_strcpy
push 0x412166
lea eax, [ebp - 0x240]
push eax
call sub.CRTDLL.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x240]
mov dword [ebp - 0x40], eax
mov byte [edi], 0x5c
jmp 0x40c98d
and dword [ebp - 0x40], 0
mov eax, dword [ebp + 0x10]
or eax, eax
je 0x40c99c
cmp byte [eax], 0
je 0x40c99c
mov dword [ebp - 0x40], eax
xor edi, edi
inc edi
test byte [ebp + 0x14], 2
je 0x40c9a7
xor edi, edi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x20], edi
lea eax, str.Open
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov ebx, eax
or eax, eax
je 0x40c9f8
cmp dword [ebp - 4], 0
je 0x40c9f8
test byte [ebp + 0x14], 1
je 0x40c9f5
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40dd60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 9
call sub.USER32.dll_GetKeyState
mov ebx, eax
movsx ebx, bx
test bl, 0x80
je 0x40ddda
push 0x11
call sub.USER32.dll_GetKeyState
mov ebx, eax
movsx ebx, bx
test bl, 0x80
jne 0x40ddda
push 0x10
call sub.USER32.dll_GetKeyState
mov ebx, eax
movsx ebx, bx
test bl, 0x80
jne 0x40ddda
push 0x12
call sub.USER32.dll_GetKeyState
mov ebx, eax
movsx ebx, bx
test bl, 0x80
jne 0x40ddda
call sub.USER32.dll_GetFocus
push 5
lea ebx, [ebp - 5]
push ebx
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 5]
push eax
call sub.CRTDLL.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x40ddda
jmp 0x40de20
mov edi, dword [0x413a78]
jmp 0x40ddee
cmp dword [edi + 8], esi
jne 0x40ddec
mov eax, dword [edi + 0x14]
jmp 0x40de20
mov edi, dword [edi]
or edi, edi
jne 0x40dde2
jmp 0x40de16
mov ebx, edi
shl ebx, 4
mov edx, dword [0x413a34]
cmp dword [edx + ebx], esi
jne 0x40de15
mov ebx, edi
shl ebx, 4
mov edx, dword [0x413a34]
mov eax, dword [ebx + edx + 0xc]
jmp 0x40de20
inc edi
cmp edi, dword [0x413a30]
jl 0x40ddf4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c165
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov edi, ecx
push 0x411d60
push dword [ebx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00403b20
add esp, 0xc
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0xb4]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 0
push 0
push 0xc
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
call esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
movups xmm0, xmmword [ebp - 0x48]
push eax
push edi
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x94]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push 0x411d6c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x411d70
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011d2
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e10
push 0x411e20
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e30
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411de0
push 0x411e00
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4011f1
lea eax, [esp + 4]
push eax
push 0x411de0
push 0x411e00
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411df0
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a7d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401abc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401abc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401abc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401abc
cmp dword [ecx + 0x74], 0xe
jbe 0x401abc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bf9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bf9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40148e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x47eb90]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401523
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014e0
cmp dword [ebp + 0x10], ebx
jne 0x401517
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040148e
test eax, eax
jne 0x4014f2
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.0040632a
cmp eax, ebx
je 0x40152a
push ebx
push dword [0x47eb90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401523
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x47eb90], ebx
jne 0x401520
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401520
jmp 0x401523
Function at 0x405c71
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x461dd0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x461dd0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405cac
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405e61
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405e7e
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405e81
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405eb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a65c]
mov dword [ebp - 8], eax
mov eax, dword [0x40a660]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405f00
test edi, edi
jne 0x405ebd
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405efa

Function at 0x405f04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f78
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f65
cmp dword [ebp + 0x14], 1
je 0x405f68
cmp dword [ebp + 0x14], 2
je 0x405f68
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x4006], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x406115
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40613e
mov eax, dword [0x40c058]
cmp eax, 0xffffffff
je 0x406132
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40c058], 0xffffffff
jmp 0x4061e9
cmp dword [0x46d204], ebx
je 0x4061e9
cmp word [0x476240], bx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x4061b5
cmp dword [0x40c058], 0xffffffff
jne 0x4061be
mov esi, 0x476240
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405e81
cmp eax, 0xffffffff
mov dword [0x40c058], eax
je 0x4061e7
cmp dword [ebp + 8], 0xffffffff
jne 0x4061aa
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40c058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40c058], 0xffffffff
je 0x4061e7
push 0x40a678
mov esi, 0x46d220
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40c058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4067a2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x461e18
push esi
call fcn.00406037
push esi
call fcn.00405d8a
mov edi, eax
test edi, edi
jne 0x4067c3
xor eax, eax
jmp 0x406821
push edi
call fcn.00406066
test byte [0x47eb08], 0x80
je 0x4067e0
movzx eax, word [edi]
test ax, ax
je 0x4067bf
cmp ax, 0x5c
je 0x4067bf
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x406802
push esi
call fcn.00406303
test eax, eax
je 0x4067fc
test byte [eax], 0x10
je 0x406826
push esi
call fcn.00406776
push esi
call ebx
cmp eax, edi
jg 0x4067ed
push esi
call fcn.00406747
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x406820
Function at 0x406abb
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x40a888
mov ebx, 0x465e20
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x400
je 0x406b09
push 1
push ebp
push edi
call fcn.00405e81
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c80
cmp eax, esi
jg 0x406c80
push esi
mov edi, 0x46b478
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c80
cmp eax, esi
jg 0x406c80
push ebp
push ebp
push esi
push 0x466620
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406c80
push ebp
push ebp
push esi
mov esi, 0x466c70
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406c80
push esi
push 0x466620
push str._s_s_r_n
push 0x467070
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x47eabc]
push dword [eax + 0x128]
push edi
call fcn.0040682a
push 4
push 0xc0000000
push edi
call fcn.00405e81
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x406c80
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406c76
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406c76
cmp edi, dword [esp + 0x10]
jne 0x406c76
push str._Rename__r_n
push esi
call fcn.00405de7
cmp eax, ebp
jne 0x406c0d
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406c3e
push 0x40a87c
add eax, 0xa
push eax
call fcn.00405de7
mov ebp, eax
test ebp, ebp
je 0x406c3c
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406c2f
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406c29
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x406c40
xor ebp, ebp
mov eax, edi
push ebx
push 0x467070
add eax, esi
push eax
call fcn.00405e3d
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4071e6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x407221
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4071fa
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4071f5
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40724e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40722f
not eax
pop ebp
ret 0xc
Function at 0x401fb7
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x40119c
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40200c
push 4
lea eax, [ebp - 8]
push eax
push 4
push ebx
push 0x401194
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402003
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x40236e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408004]
jne 0x40237f
test ecx, 0xffff0000
jne 0x40237f
ret
jmp fcn.00402389

Function at 0x4024fe
Capabilities:
Accept command line arguments

Disassembly:
push 0x18
push 0x4013a0
call fcn.004033c4
mov ebx, 0x94
push ebx
push 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40253f
mov dword [esi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
test eax, eax
jne 0x402549
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x402696
mov eax, dword [esi + 0x10]
mov dword [0x4089b4], eax
mov eax, dword [esi + 4]
mov dword [0x4089c0], eax
mov eax, dword [esi + 8]
mov dword [0x4089c4], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x4089b8], eax
xor ebx, ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x4089b4], 2
je 0x40258a
or byte [0x4089b9], 0x80
mov eax, dword [0x4089c0]
shl eax, 8
add eax, dword [0x4089c4]
mov dword [0x4089bc], eax
call fcn.0040249d
mov dword [ebp - 0x1c], eax
push ebx
call fcn.00403365
pop ecx
test eax, eax
jne 0x4025d1
cmp dword [0x4089a4], 2
je 0x4025be
call fcn.00402b9b
push 0x1c
call fcn.00402a35
push 0xff
call fcn.00402894
pop ecx
pop ecx
mov dword [ebp - 4], ebx
call fcn.0040317e
test eax, eax
jge 0x4025e5
push 0x1b
call fcn.0040246e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40a274], eax
call fcn.00403051
mov dword [0x40899c], eax
call fcn.00402fa9
test eax, eax
jge 0x40260b
push 8
call fcn.0040246e
pop ecx
call fcn.00402d51
test eax, eax
jge 0x40261c
push 9
call fcn.0040246e
pop ecx
call fcn.004028ee
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x40262f
push eax
call fcn.0040246e
pop ecx
mov eax, dword [0x4089d4]
mov dword [0x4089d8], eax
push eax
push dword [0x4089cc]
push dword [0x4089c8]
call fcn.004021d7
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40265e
push esi
call fcn.004029ce
call fcn.00402a06
jmp 0x402690
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004033ff
ret
Function at 0x402a35
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x408010]
je 0x402a57
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x402a45
cmp esi, 0x13
je 0x402b93
mov eax, dword [0x4089a4]
cmp eax, 1
push ebx
je 0x402b62
test eax, eax
jne 0x402a80
cmp dword [0x40800c], 1
je 0x402b62
cmp ecx, 0xfc
je 0x402b92
push edi
push 6
pop ecx
mov esi, 0x401730
mov edi, 0x4089f8
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x408a12
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x408b16], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402ace
push 5
pop ecx
mov esi, 0x401718
mov edi, 0x408a12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ad3
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x402b06
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ae7
sub eax, edx
push 3
lea eax, [eax + 0x4089d7]
push 0x401714
push eax
call fcn.004026b0
add esp, 0xc
mov edx, 0x4089f8
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b0e
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x408014]
mov esi, 0x401710
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402b2a
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402b36
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x4016e8
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004040ca
add esp, 0xc
pop edi
jmp 0x402b92
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x402b92
mov edx, dword [esi*8 + 0x408014]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x402b7a
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x403051
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x408e20]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x40309d
call esi
mov edi, eax
cmp edi, ebx
je 0x403083
mov dword [0x408e20], 1
jmp 0x4030a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x403098
push 2
pop eax
mov dword [0x408e20], eax
jmp 0x40309d
mov eax, dword [0x408e20]
cmp eax, 1
jne 0x40311a
cmp edi, ebx
jne 0x4030ae
call esi
mov edi, eax
cmp edi, ebx
je 0x403123
cmp word [edi], bx
mov eax, edi
je 0x4030c3
inc eax
inc eax
cmp word [eax], bx
jne 0x4030b5
inc eax
inc eax
cmp word [eax], bx
jne 0x4030b5
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x403111
call fcn.0040420c
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x403111
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x40310e
push dword [ebp - 4]
call fcn.004041ca
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x403172
cmp eax, 2
je 0x403127
cmp eax, ebx
je 0x403127
xor eax, eax
jmp 0x403174
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x403123
cmp byte [esi], bl
je 0x403144
inc eax
cmp byte [eax], bl
jne 0x40313a
inc eax
cmp byte [eax], bl
jne 0x40313a
sub eax, esi
inc eax
mov edi, eax
mov ecx, edi
call fcn.0040420c
cmp eax, ebx
je 0x40316b
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret