joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021b0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call fcn.0040f97f
xor eax, eax
add esp, 0x14
cmp dword [esi + 0x260], 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
jne 0x40220b
push eax
call fcn.0040fc13
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x402240
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040eff8
mov esp, ebp
pop ebp
ret

Function at 0x4022a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x4022c1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x402300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4022ea
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], edi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push str.LocalService
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402db3
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x402d81
cmp eax, 2
jne 0x402d9d
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x402dad
test ecx, ecx
je 0x402da8
test cl, 1
jne 0x402d9d
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x402dad
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x403cc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x403cd5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x403ce0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403ce0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403d60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x403d79
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403d85
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x403d80
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4277f6
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x438], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x420], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x4051cc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x4051cc
call fcn.004035f0
mov esi, eax
jmp 0x4052bc
push dword [ebp - 0x428]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4051ef
call fcn.004035f0
jmp 0x4052af
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x40520d
call fcn.004035f0
jmp 0x4052af
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x428], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40522e
mov esi, 0x8007000e
jmp 0x4052b1
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.004035a0
jmp 0x405258
mov dword [ebp - 4], 1
cmp dword [ebp - 0x420], 0
jne 0x40526f
mov esi, 0x8007000e
jmp 0x4052b1
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40528f
call fcn.004035f0
jmp 0x4052af
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x420]
call fcn.00404fc0
mov esi, eax
test edi, edi
je 0x4052bc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x4052e0
lea ecx, [ebp - 0x420]
call fcn.00403550
jmp 0x4052e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4086b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
call fcn.0040b770
cmp dword [esi + 8], 0xffffffff
je 0x4086e9
push ecx
push 1
lea eax, [esp + 0xc]
mov byte [esp + 0xc], 0x23
push eax
mov ecx, esi
call fcn.00409f10
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov eax, dword [esi + 4]
test eax, eax
je 0x408724
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x408714
cmp dword [esi + 0xc], 0
jne 0x408714
push 0x102
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
call fcn.0040b8b0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409f10
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x427ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4375dc]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov eax, dword [0x4375dc]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 4], 0
mov ecx, dword [ebp + 8]
je 0x40a0c2
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x40a0c2
mov edi, dword [ebp + 0xc]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov dword [esp + 0x28], 0
push edx
push edi
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push eax
movdqa xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409fa7
cmp dword [esp + 0xc], edi
jne 0x409fa7
mov eax, 1
jmp 0x40a0c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40a0c2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [esp + 0x10], eax
cmp dword [esi + 0xc], 0
jne 0x409fdb
call edi
sub eax, dword [esp + 0x10]
cmp eax, 0x1d4c0
jae 0x40a0ab
cmp dword [esp + 0x14], 0x103
jne 0x409f9d
lea ecx, [esp + 0x68]
call fcn.00407e00
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x94], 0
call fcn.0040b9f0
add esp, 4
push 0x43098c
mov edx, eax
mov byte [esp + 0x94], 1
lea ecx, [esp + 0x54]
call fcn.0040b260
add esp, 4
mov ecx, eax
mov byte [esp + 0x90], 2
call fcn.0040ba70
cmp dword [esp + 0x64], 0x10
jb 0x40a043
push dword [esp + 0x50]
call fcn.0040eff3
add esp, 4
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
jb 0x40a06b
push dword [esp + 0x38]
call fcn.0040eff3
add esp, 4
mov dword [esp + 0x90], 0xffffffff
cmp dword [esp + 0x7c], 0x10
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
jb 0x40a09e
push dword [esp + 0x68]
call fcn.0040eff3
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409fc4
cmp dword [esp + 0x14], 0x103
jne 0x409f9d
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
xor eax, eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a150
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x40a202
mov eax, dword [esi + 8]
test eax, eax
je 0x40a202
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0
push ecx
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push eax
movdqu xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a1b3
cmp dword [ebp - 4], edi
jne 0x40a1b3
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40a202
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0xc], eax
cmp dword [esi + 0xc], 0
jne 0x40a1e1
call ebx
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x40a1f0
cmp dword [ebp - 0x18], 0x103
jne 0x40a1a5
push 0xa
call edi
jmp 0x40a1d1
cmp dword [ebp - 0x18], 0x103
jne 0x40a1a5
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40de90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x20119
push esi
push esi
push esi
push str.SoftwareFuturemarkFuturemark_SystemInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40def5
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push esi
push str.Debugging
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
cmove esi, dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40df00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x20119
push esi
push esi
push esi
push str.SoftwareFuturemarkFuturemark_SystemInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40df65
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push esi
push str.RedirectOutput
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
cmove esi, dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d8e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004139d5
mov dword [ebp - 0x14], eax
cmp dword [0x43aa20], esi
jne 0x41d9d5
push 0x800
push esi
push 0x42e234
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41d962
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41dab5
push esi
push esi
push 0x42e234
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41dab5
push 0x42e24c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dab5
push eax
call ebx
push 0x42e258
push edi
mov dword [0x43aa20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x42e268
push edi
mov dword [0x43aa24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x42e27c
push edi
mov dword [0x43aa28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aa30], eax
test eax, eax
je 0x41d9d2
push 0x42e298
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aa2c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d9fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41d9ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41da0f
push 4
pop eax
jmp 0x41dab7
cmp dword [ebp - 0x14], esi
je 0x41da0f
push dword [0x43aa20]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41d9f4
mov eax, dword [0x43aa2c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41da6d
cmp dword [0x43aa30], edi
je 0x41da6d
push eax
call ebx
push dword [0x43aa30]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41da6d
test eax, eax
je 0x41da6d
call ecx
test eax, eax
je 0x41da62
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41da62
test byte [ebp - 8], 1
jne 0x41da6d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41da9d
mov eax, dword [0x43aa24]
cmp eax, edi
je 0x41da9a
push eax
call ebx
test eax, eax
je 0x41da9a
call eax
mov esi, eax
test esi, esi
je 0x41da9a
mov eax, dword [0x43aa28]
cmp eax, edi
je 0x41da9a
push eax
call ebx
test eax, eax
je 0x41da9a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43aa20]
call ebx
test eax, eax
je 0x41dab5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41dab7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eff8
mov esp, ebp
pop ebp
ret
Function at 0x426590
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x43aa88], 0
je 0x4265bc
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xc], 0
call esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.00401450
cmp al, 1
jne 0x4265e5
push ecx
call fcn.004012c0
mov ebx, eax
jmp 0x4265e8
mov ebx, dword [ebp - 0xc]
cmp dword [0x43ad50], 0
jne 0x426600
cmp byte [0x43ab2e], 0
je 0x426600
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
js 0x42669d
call esi
mov ecx, dword [0x42f898]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov cx, word [0x42f89c]
mov word [ebp - 8], cx
mov ecx, eax
call fcn.00402fb0
mov esi, eax
test esi, esi
je 0x42669d
push edi
mov edi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x426640
mov edx, 0x42f8a0
mov ecx, esi
call fcn.00402f10
test eax, eax
jne 0x426657
call fcn.004264c0
mov ebx, eax
cmp word [esi], 0
je 0x426688
lea eax, [ebp - 0xc]
movzx ecx, word [eax]
test cx, cx
je 0x426674
cmp word [esi], cx
je 0x42667f
push eax
call edi
test eax, eax
jne 0x426660
push esi
call edi
mov esi, eax
test esi, esi
jne 0x426657
jmp 0x426688
push esi
call edi
mov esi, eax
test esi, esi
jne 0x426640
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00423bd3
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401104
pop ecx
mov esi, ebp
call fcn.0040e687
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e68d
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401104
add esp, 0xc
inc esi
call fcn.0040e687
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040120f
call fcn.00401277
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401127
pop ecx
pop ecx
mov esi, eax
call fcn.0040127d
mov edx, ebp
test ebx, ebx
jle 0x4010b0
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x4010a5
mov edi, dword [0x431004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010bf
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cb
mov edx, dword [esi]
mov ecx, dword [0x431990]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42526c
push 0x425270
push dword [0x431994]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d57
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00423bd3
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.00423bd3
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00423bd3
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00423bd3
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.00423bd3
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.00423bd3
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.00423bd3
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.00423bd3
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x423bd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x423be2
pop dword [ebp - 0x3c]
mov eax, 0xf8313f16
add eax, 0x810fccc
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xfce4f03b
sub dword [ebp - 0x4c], 0xae92aaf0
mov dword [ebp - 0x48], 0x602ed1c1
add dword [ebp - 0x48], 0xd2047a84
mov dword [ebp - 0x44], 0x7f842641
sub dword [ebp - 0x44], 0x3337e213
mov dword [ebp - 0x40], 0xf0165f2b
add dword [ebp - 0x40], 0xfe9a0d5
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xcf837cc6
add eax, 0x30bed38e
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd0e62fa3
add dword [ebp - 0x4c], 0xa38c39b3
mov dword [ebp - 0x48], 0xa3cdf4f5
sub dword [ebp - 0x48], 0x62619380
mov dword [ebp - 0x44], 0x7797159
sub dword [ebp - 0x44], 0xa40a04ed
mov dword [ebp - 0x40], 0xa29274c9
add dword [ebp - 0x40], 0x5d6d8b37
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x5e006fea
sub eax, 0x5dbe1f92
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f23f
push 0
call eax
mov ecx, 0xca320736
sub ecx, 0xca31b9a1
mov edi, eax
mov ebx, 0x23d54e8b
sub ebx, 0x2391748b
add ebx, dword [ebp - 0x3c]
mov edx, 0xfcc4dec6
xor dword [ebp - 4], 0x3a55dd40
mov esi, dword [ebx]
xor dword [ebp - 0x1c], ebx
xor esi, edx
xor dword [ebp - 0x18], ebx
mov dword [edi], esi
add dword [ebp - 0xc], esi
add edi, 4
add ebx, 4
loop 0x423cfe
add eax, 0x9a313ee4
sub eax, 0x9a3015bd
xor ebx, ebx
add ebx, eax
add eax, 0xddad8741
sub eax, 0xddad873c
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1004827
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x100483c
popal
leave
ret 0xc

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c