joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426c10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472afb
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x48f088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x426ded
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00449888
xor ebx, ebx
mov dword [edi + 4], eax
add esp, 4
cmp dword [edi], ebx
jle 0x426db8
nop
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov edx, dword [eax + ebx*4]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x48], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426cd2
sub eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
push edx
call fcn.0040c030
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00416590
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
mov eax, dword [edi + 0xc]
push ecx
cmp dword [edi + 0x10], eax
je 0x426d1d
mov ecx, eax
call fcn.0040ada0
add dword [edi + 0xc], 0x18
jmp 0x426d26
push eax
lea ecx, [edi + 8]
call fcn.0040fab0
mov ecx, dword [edi + 0xc]
add ecx, 0xffffffe8
cmp dword [ecx + 0x14], 0x10
jb 0x426d34
mov ecx, dword [ecx]
mov eax, dword [edi + 4]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
mov dword [eax + ebx*4], ecx
cmp edx, 0x10
jb 0x426d72
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x426d68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426de8
push edx
push ecx
call fcn.0044945e
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x426dac
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x426da2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426de8
push edx
push ecx
call fcn.0044945e
add esp, 8
inc ebx
cmp ebx, dword [edi]
jl 0x426cb0
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push dword [ebp - 0x44]
mov dword [eax + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448dec
mov esp, ebp
pop ebp
ret
call fcn.0044e6c9
push str.Failed_to_parse_command_line_arguments
lea ecx, [ebp - 0x1c]
call fcn.00401340
push 0x48d604
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ac55
int3
Function at 0x427a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x14
push esi
sub eax, 1
je 0x427ae2
sub eax, 1
je 0x427a85
mov dword [ebp - 0x14], 7
xor ecx, ecx
mov dword [ebp - 0x10], 0xd500cf
mov dword [ebp - 0xc], 0xd300d7
mov dword [ebp - 8], 0xc800d1
mov dword [ebp - 4], 0xc100ae
nop dword [eax]
lea eax, [ecx + 0xba]
xor word [ebp + ecx*2 - 0x10], ax
inc ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jb 0x427a40
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0x10], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0x10]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427a72
lea eax, [ebp - 0x10]
jmp 0x427b41
mov dword [ebp - 0x10], 5
xor ecx, ecx
mov dword [ebp - 0xc], 0xcf00d2
mov dword [ebp - 8], 0xcd00c8
mov dword [ebp - 4], 0xbf00cd
lea eax, [ecx + 0xba]
xor word [ebp + ecx*2 - 0xc], ax
inc ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jb 0x427aa3
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0xc], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427ad5
jmp 0x427b3e
mov eax, 4
mov dword [ebp - 0xc], 0xcf00d2
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 8], 0xcd00c8
mov dword [ebp - 4], 0xbe
lea eax, [ecx + 0xba]
xor word [ebp + ecx*2 - 0xc], ax
inc ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jb 0x427b01
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0xc], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427b33
lea eax, [ebp - 0xc]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c030
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x437870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473e07
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48f088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x437924
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x68]
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
call fcn.00437610
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 4], 6
mov byte [ebp - 0xd], 1
test ecx, ecx
jns 0x437962
mov eax, ecx
neg eax
je 0x437962
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x43796a
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.0041ae20
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x437999
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x445610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x48f088]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 0xde00ee
mov dword [ebp - 0x10], 0xdc00d0
mov dword [ebp - 0xc], 0xd000d3
mov dword [ebp - 8], 0xc100ae
nop dword [eax]
lea ecx, [eax + 0xba]
xor word [ebp + eax*2 - 0x14], cx
inc eax
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x445650
xor eax, eax
mov word [ebp + ecx*2 - 0x14], ax
lea ecx, [ebp - 0x14]
mov dword [esi + 0x10], eax
lea edx, [ecx + 2]
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445680
sub ecx, edx
lea eax, [ebp - 0x14]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c030
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00448dec
mov esp, ebp
pop ebp
ret

Function at 0x4456b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x48f088]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x71]
mov dword [ebp - 0x78], edi
call fcn.00443ad0
mov esi, eax
xor eax, eax
mov ecx, dword [esi]
lea edx, [esi + 4]
test ecx, ecx
je 0x4456f2
lea ecx, [eax + 0xba]
xor word [edx + eax*2], cx
inc eax
mov ecx, dword [esi]
cmp eax, ecx
jb 0x4456e1
xor eax, eax
mov word [edx + ecx*2], ax
mov ecx, edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445710
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040c030
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00448dec
mov esp, ebp
pop ebp
ret
Function at 0x46143d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004612b3

Function at 0x4676eb
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046766d

Function at 0xdb9384
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb938e
pushal
call 0xdb9394
pop ebp
sub ebp, 0x10
sub ebp, 0x9b9384
jmp 0xdb93aa
add byte [eax], al
pop ds
mov al, 0x21
sbb dword [eax + 0x9b9384], edi
mov eax, 0x9b9384
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0xbc77b725
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb93c1
jmp 0xdb93d4
scasb al, byte es:[edi]
call 0x25f54088
and eax, 0xdde4a425
and eax, 0xe8262525
popfd
and esp, dword [0xd9f2525]
and eax, 0xc7d22525
in eax, dx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
sub dword [0xe0262525], esp
jne 0xdb93a4
inc ecx
add ecx, ebx
lodsb al, byte [esi]
and dword [ecx], eax
dec ebp
std
call 0x8a28b90d
loopne 0xdb9467
and eax, 0x4d010924
invalid
add dword [ebp + ecx*8 + 0x20], esi
and eax, 0x6ecc2525
daa
and eax, 0x141a825
fldcw word [ecx + ecx - 0x253651ff]
push eax
sub edx, ebx
push eax
sub eax, 0x25255dcd
and eax, 0x252d98ae
and eax, 0xa4ec1625
xlatb
push ecx
sub dl, al
pop esi
movsb byte es:[edi], byte [esi]
xlatb
push ecx
sub dl, al
pop esi
push ss
mul dword [esi + 0x2a6d20cd]
mov eax, dword [0x2525256b]
sub ch, byte [ebp + 0x2525256d]
inc ebx
scasb al, byte es:[edi]
cmp dword [0xa12acdde], ebx
aas
and eax, 0xdea52525
int3
Function at 0x4031e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 4], ecx
push ebx
xor ecx, ecx
mov dword [ebp - 8], eax
xor ebx, ebx
push esi
lea esi, [eax + 0xf8]
cmp cx, word [eax + 6]
jae 0x403284
mov ecx, dword [ebp + 0x100]
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
mov edi, dword [ebp + 0x40]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40323d
test edi, edi
jle 0x403274
mov eax, dword [esi + 0xc]
push 0x40
push 0x1000
push edi
add eax, ecx
push eax
call edx
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.005d3450
jmp 0x403262
push 0x40
push 0x1000
push eax
mov eax, dword [esi + 0xc]
add eax, ecx
push eax
call edx
push dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edi, eax
add ecx, dword [ebp - 4]
push ecx
push edi
call fcn.005d3d00
mov dword [esi + 8], edi
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esp, 0xc
mov ecx, dword [ebp + 0x100]
mov edi, dword [ebp + 0x40]
mov eax, dword [ebp - 8]
inc ebx
add esi, 0x28
movzx eax, word [eax + 6]
cmp ebx, eax
jl 0x403214
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403490
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
xor eax, eax
push esi
lea esi, [ebx + 0xf8]
cmp ax, word [ebx + 6]
jae 0x403585
push edi
nop dword [eax]
nop dword [eax + eax]
mov edx, dword [esi + 0x24]
test edx, 0x2000000
jne 0x40356e
mov eax, edx
shr eax, 0x11
and eax, 0x200
test edx, 0x20000000
je 0x403509
test edx, 0x40000000
je 0x4034f9
test edx, edx
jns 0x4034f4
or eax, 0x80
jmp 0x40352c
or eax, 0x20
jmp 0x40352c
test edx, edx
jns 0x403504
or eax, 0x80
jmp 0x40352c
or eax, 0x10
jmp 0x40352c
test edx, 0x40000000
je 0x40351f
test edx, edx
jns 0x40351a
or eax, 4
jmp 0x40352c
or eax, 2
jmp 0x40352c
mov ecx, eax
or eax, 1
or ecx, 8
test edx, edx
cmovs eax, ecx
mov edi, eax
mov ecx, edx
or edi, 0x200
and ecx, 0x4000000
mov ecx, dword [esi + 0x10]
cmove edi, eax
test ecx, ecx
jne 0x40356e
test dl, 0x40
je 0x403550
mov eax, dword [ebx + 0x20]
jmp 0x403557
test dl, dl
jns 0x40356e
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x40356e
lea eax, [ebp - 8]
push eax
push edi
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x403584
mov edx, dword [ebp - 4]
add esi, 0x28
movzx eax, word [ebx + 6]
inc edx
mov dword [ebp - 4], edx
cmp edx, eax
jl 0x4034c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
movups xmm0, xmmword [ecx + 0x10]
push ebx
movups xmm1, xmmword [ecx]
mov edx, 0x5a4d
mov dword [ebp - 0xc], ecx
movups xmmword [ebp - 0x40], xmm0
push esi
movups xmm0, xmmword [ecx + 0x20]
push edi
movd eax, xmm1
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x10], 0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [ebp - 0x20], xmm0
cmp ax, dx
jne 0x403727
mov esi, dword [ebp - 0x14]
lea edi, [ebp - 0x148]
add esi, ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x148], 0x4550
jne 0x403727
mov esi, dword [ebp - 0xf8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x2000
push esi
push dword [ebp - 0x114]
call edi
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x403632
push 0x40
push 0x2000
push esi
push eax
call edi
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x403727
push 0x40
push 0x1000
push esi
push ebx
call edi
mov esi, dword [ebp - 0xf4]
push 0x40
push 0x1000
push esi
push ebx
call edi
mov ecx, dword [ebp - 0x14]
mov edi, eax
add ecx, esi
push ecx
push dword [ebp - 0xc]
push edi
call fcn.005d3d00
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x148]
add esp, 0xc
lea eax, [edi + ecx]
mov dword [edi + ecx + 0x34], ebx
push ebx
sub esp, 0xf8
mov dword [ebp - 8], eax
mov ecx, 0x3e
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov edx, esi
call fcn.004031e0
mov edx, dword [ebp + 8]
add esp, 0xfc
test edx, edx
cmove edx, ebx
sub edx, dword [ebp - 0x114]
je 0x4036b2
push ebx
mov ecx, esi
call fcn.004032a0
add esp, 4
mov edx, ebx
mov ecx, esi
call fcn.00403350
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x4036d7
test ebx, ebx
je 0x4036d7
push 0x4000
push dword [ebp - 0xf8]
push ebx
call edi
mov ecx, esi
call fcn.00403490
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40370a
add eax, ebx
mov dword [ebp - 8], eax
je 0x40370a
cmp eax, ebx
jbe 0x40370a
pushal
push 0
push 1
push dword [ebp - 4]
mov eax, dword [ebp - 8]
call eax
mov dword [ebp - 0x10], eax
popal
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0x10], 0
je 0x403719
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
push dword [ebp - 0xf8]
push ebx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403bc0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x6bde74]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0
push eax
push 0xf013f
push 0
push str.SoftwareCheckList_Bc_StartFlags
push SysReAllocStringLen
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c2a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push str.falgs
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 0xacfbfb
je 0x403d25
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
push str..map3.map
mov dword [ebp - 0x10], 0x646e6567
mov dword [ebp - 0xc], 0x20666f20
mov word [ebp - 8], 0x694d
mov byte [ebp - 6], 0x72
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x403c91
push 0
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push ecx
push 0x64
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 0x6d]
mov esi, 7
lea edx, [ebp - 0x10]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x403cc1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x403ca0
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x403cc1
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
je 0x403cd5
push 0
push 0x686d10
push 0x686d1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
lea eax, [ebp - 0x78]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareCheckList_Bc_StartFlags
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
jne 0x403d25
push 4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0xacfbfb
push eax
push 4
push 0
push str.falgs
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cebb7
mov esp, ebp
pop ebp
ret
Function at 0x403f60
Capabilities:
Check for time delay via gettickcount
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x6bde74]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x4c]
push edi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [esp + eax + 0x50], 0x74782d54
add eax, 4
cmp eax, 0x400
jae 0x404177
push 0
push 0x80
push 3
push 0
push 1
mov byte [esp + eax + 0x64], 0
lea eax, [esp + 0x64]
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, dword [0x11efa40]
cmp ecx, 1
jne 0x403ffa
cmp ebx, 0xffffffff
jne 0x404069
call edi
mov ecx, dword [0x11ef8a8]
cmp eax, ecx
ja 0x40404b
test ecx, ecx
jne 0x40404b
mov ecx, dword [0x11efa40]
cmp ecx, 2
je 0x404069
cmp ecx, 4
jne 0x403fd6
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sub eax, 2
je 0x404156
sub eax, 0xd
je 0x404125
sub eax, 0x102
je 0x40410e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.005cebb7
mov esp, ebp
pop ebp
ret 0x10
call edi
add eax, 0xa
mov dword [0x11efb10], 0
mov dword [0x11ef8a8], eax
mov dword [0x11efb14], 0
mov ecx, dword [0x11e29f0]
xor edx, edx
movaps xmm2, xmmword [0x686d40]
mov dword [0x11efa40], 3
movd xmm0, ecx
pshufd xmm3, xmm0, 0
nop dword [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm0, xmm0, 0
movaps xmm1, xmm3
paddd xmm0, xmm2
psubd xmm1, xmm0
movd xmm0, eax
movups xmmword [edx*4 + 0x11ef8b0], xmm1
pshufd xmm0, xmm0, 0
movaps xmm1, xmm3
paddd xmm0, xmm2
psubd xmm1, xmm0
movups xmmword [edx*4 + 0x11ef8c0], xmm1
add edx, 8
cmp edx, 0x60
jl 0x404090
cmp edx, 0x64
jge 0x4040ee
lea eax, [edx*4 + 0x11ef8b0]
sub ecx, edx
mov dword [eax], ecx
add eax, 4
dec ecx
cmp eax, 0x11efa40
jl 0x4040e1
call fcn.004038c0
mov eax, dword [esp + 0x18]
push 0
mov dword [0x11efa44], eax
mov dword [0x11efa40], 4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x10]
cmp ax, 0x69
je 0x40415e
push dword [ebp + 0x14]
push eax
push 0x111
jmp 0x40402d
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.005cebb7
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [esp + 0x454]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005cebb7
mov esp, ebp
pop ebp
ret 0x10
call fcn.005cf3a3
int3
Function at 0x40c04d
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x6255b8
call fcn.005cf951
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040689c
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x40c0af
call fcn.00405a19
cmp eax, 1
jne 0x40c0af
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040b2e4
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004092a9
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00405cb9
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x40c0c1
call fcn.0040c595
jmp 0x40c0c7
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00405cb9
mov eax, esi
call fcn.005cf91a
ret 0xc

Function at 0x40c212
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x625639
call fcn.005cf951
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040689c
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x40c270
call fcn.00405a19
cmp eax, 1
jne 0x40c270
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040b2e4
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004092a9
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00405cb9
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00405cb9
mov eax, esi
call fcn.005cf91a
ret 0x10

Function at 0x40c297
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x625664
call fcn.005cf951
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040689c
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x40c2f5
call fcn.00405a19
cmp eax, 1
jne 0x40c2f5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040b2e4
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004092a9
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00405cb9
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00405cb9
mov eax, esi
call fcn.005cf91a
ret 0x14