joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10902c70
Capabilities:
Encode data using xor

Disassembly:
int1
xor byte [edx - 0x215a837e], dh
test dword [esi - 0x4c446a73], edx
push es
invalid
js 0x10902bcf
xchg dword [eax], ebp
pop edi
cmp eax, 0xfa977753
xchg edi, eax
cli
cmp eax, 0xb27e3bf8
mov ebp, 0x5bac007b
mov bl, 0x8d
movsb byte es:[edi], byte [esi]
clc
imul byte [edi]
invalid
adc ah, dh
rcr bl, 0xa1
inc ebx
mov esi, 0xbe43a1db
invalid
nop
or edx, dword [ecx - 0x79]
loopne 0x10902be0
bound eax, qword [ebp - 6]
xchg ecx, eax
push ss
push eax
cmp byte [edx - 2], 0x5a
ja 0x10902be3
add al, byte [ebp - 0x4588e09f]
test dword [ecx + 0x1f], esp
pop ds
ja 0x10902ba0
mov eax, dword [0xfe00ea67]
js 0x10902c4c
push ecx
push edi
jbe 0x10902b88
xchg edi, eax
add ah, dl
popal
cli
les edx, [ebx]
cli
xchg ecx, eax
pop ss
imul dword [edx]
pop edi
movsb byte es:[edi], byte [esi]
push esp
jbe 0x10902b98
add ah, dl
jns 0x10902bfe
sub byte [ecx - 0x2441bc48], dl
mov eax, dword [0xa1dbbe43]
mov edi, 0x9b139a30
jns 0x10902bb3
nop
or edx, dword [eax - 0x79]
loopne 0x10902c30
bound eax, qword [ebp - 6]
xchg ecx, eax
push ss
push eax
cmp byte [edx - 2], 0x5a
ja 0x10902c33
add al, byte [ebp - 0x4588e09f]
test dword [ecx + 0x1f], esp
pop ds
ja 0x10902bf0
mov eax, dword [0xfe00ea67]
js 0x10902c9c
mov eax, dword [0x977657]
aam 0x61
cli
les edx, [ebx]
cli
xchg ecx, eax
pop ss
neg dword [0x67a1ba5f]
ljmp 0x628d
pop edi
mov edx, 0xa5ea67a1
fidivr word [esp + edi*2]
lea esp, [edx - 0x61]
lahf
add al, byte [edx + 0x30]
ja 0x10902c57
rcr dword [ebx], 0x15
sub al, 0xd5
mov eax, dword [0xa1dbbe43]
inc ebx
mov esi, 0xbe43a1db
invalid
add bh, byte [edx]
xor eax, 0x8736ea67
sub al, 2
or dh, byte [edi + ebp*2]
or byte [edx - 0x64], ch
ja 0x10902c18
lea esi, [ecx]
dec eax
insd dword es:[edi], dx
dec ecx
sub cl, byte [eax]
invalid
xchg edx, eax
add esp, edx
popal
jp 0x10902c36
xchg edi, eax
nop
xchg byte [ecx], al
lcall 0x9b03, 0x9a8d9777
imul ebx, dword [edx + 0x300f0274], 0xe88640f8
push ebp
xchg edi, eax
lea esi, [ecx]
iretd

Function at 0x10903990
Capabilities:
Encode data using xor

Disassembly:
add bh, byte [edx]
xor eax, 0x8bf8ea7f
pop ebx
jg 0x10903992
adc al, 0x2a
add bl, byte [edx]
xor al, 0x5b
int1
xor al, 0x9c
or eax, dword [eax + 0x7a]
pushfd
xor edx, dword [edi - 0x4ca4ac08]
cmp eax, 0xa5ee2d60
pop edx
pushfd
xchg esi, eax
lea ebx, [ebp - 0x65ae64d5]
cmp ebx, dword [ebx - 0xed89ca3]
xor al, 0xf9
rcr byte [esi - 0x73], 1
xor ebx, esp
ret

Function at 0x10904df0
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi - 0x12], esi
clc
pop ebx
pop ebx
jg 0x10904d8e
clc
stosd dword es:[edi], eax
pop ebx
cmp eax, 0x53
pop ebx
xchg esi, edi
stosd dword es:[edi], eax
in al, 0x93
pop ebx
push ss
or eax, dword ds:[eax + 0x507b84b2]
jecxz 0x10904d91
mov ah, 0x74
mov dl, 0x84
jnp 0x10904dec
movsb byte es:[edi], byte [esi]
invalid
adc al, 0x94
dec ebp
mov bh, 0x8e
stosb byte es:[edi], al
mov ss, word [edx + edi]
push dword [ebx + 0x318d975b]
xchg edi, eax
lea esi, [ecx]
ja 0x10904ddf
out dx, al
aaa
lcall 0x9bf3, 0x9a799b23
jge 0x10904d95
or ebx, dword [ebx - 0x3b56bd8f]
invalid
Function at 0x10904e20
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi - 0x12], esi
out dx, al
clc
pop ebx
pop ebx
jg 0x10904e1e
stosd dword es:[edi], eax
pop ebx
cmp esi, 0x6b
in al, 0x8e
stosd dword es:[edi], eax
sub byte [ecx + 0xa72fcb3], ch
xchg ebp, eax
sub eax, 0xf8eee5d5
out dx, al
clc
aad 0xe5
pop ebx
pop ebx
jg 0x10904e36
stosd dword es:[edi], eax
pop ebx
cmp dword [edx], 0x29
out 2, al
sbb byte [esi + 0x13fb5768], 0xe4
push 0xe413fb57
les ecx, [edx]
daa
push ebx
push edi
xchg ebp, eax
or byte [edi], dl
cmp bh, bh
pop edx
invalid

Function at 0x40c487
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c496
pop dword [ebp - 0x48]
mov eax, 0x40c496
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xa7561941
add dword [ebp - 0x58], 0xa6fc2c0a
mov dword [ebp - 0x54], 0xd8407d58
sub dword [ebp - 0x54], 0xa60d3113
mov dword [ebp - 0x50], 0xc5279bd7
sub dword [ebp - 0x50], 0x78db57a9
mov dword [ebp - 0x4c], 0xe3801c78
add dword [ebp - 0x4c], 0x1c7fe388
lea eax, [ebp - 0x58]
push eax
mov eax, 0x1a48a71f
sub eax, 0x1a02f6bb
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x60fed022
add dword [ebp - 0x58], 0x13739934
mov dword [ebp - 0x54], 0xe5f3667a
add dword [ebp - 0x54], 0x5b78fafb
mov dword [ebp - 0x50], 0x43918778
add dword [ebp - 0x50], 0x1fdde4f4
mov dword [ebp - 0x4c], 0xc834985d
sub dword [ebp - 0x4c], 0xc834985d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x50797
push 0
call eax
mov ecx, 0x548a
mov edi, eax
mov edx, 0x476000
add edx, dword [ebp - 0x48]
mov esi, 0xd92bfb64
add esi, 0x3cb3682c
add dword [ebp - 0x24], esi
mov ebx, dword [edx]
mov dword [ebp - 0x44], 0xab922fff
add ebx, esi
xor dword [ebp - 0x30], 0x7515ad91
mov dword [edi], ebx
xor dword [ebp - 0x2c], edi
add edi, 4
add edx, 4
loop 0x40c5a2
add eax, 0x144fb
mov ebx, eax
add eax, 5
mov ecx, 0x9c6dbd54
add ecx, 0x63d242ac
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x58b0413b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x42e3d0
nop
mov ecx, 0x4b1151b9
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40151e
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x401521
xor cl, bl
sub ch, 0x95
out dx, al
clc
div esi
cmc
retf

Function at 0x40b400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [edx - 2]
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
jle 0x40b483
xor edx, edx
xor eax, dword [0x83dc1430]
mov byte [ebx], 0xc1
ljmp 0x3118
cmp esi, edx
jge 0x40b4e6
xor ecx, ecx
wait
or al, 0x3e
enter 0x2e9, 0x40
dec edx
jno 0x40b53d
ret
Function at 0x4038fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408398]
jne 0x403906
repz ret
jmp fcn.00403dae

Function at 0x64f520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6505a8
push 0x64f510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa54204], 0xffffffff
or dword [0xa54208], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa54200]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa541fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa5420c], eax
call fcn.0064f69f
cmp dword [0x6534a0], ebx
jne 0x64f5a3
push 0x64f69c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f68a
push 0x65300c
push 0x653008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa541f8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa541f4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x653004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f636
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f60a
cmp al, 0x22
jne 0x64f5fc
cmp byte [esi], 0x22
jne 0x64f613
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f61d
cmp al, 0x20
jbe 0x64f60f
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f641
movzx eax, word [ebp - 0x2c]
jmp 0x64f644
cmp byte [esi], 0x20
jbe 0x64f613
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f636
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x17
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x6a
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfd
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xde
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x39
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfd
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x88
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xaa
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc7
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xd5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbc
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8c
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x408951
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
and ecx, ecx
call fcn.00408974
sub ecx, edx
sub ecx, 0x9405b066
xor dword [edi], esi
inc edi
cmp edi, ebx
jne fcn.00408951
push 0x2d98cbf7
pop edx
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x64
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x25
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x56
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xce
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x71
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x83
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfc
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7c
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xdd
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x35
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x402450
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x402475
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, 0x4030a8
sub ecx, 0x4030a4
sar ecx, 2
push ecx
push 0x4030a4
call fcn.00402560
add esp, 8
mov edx, 0x4030a0
sub edx, 0x40309c
sar edx, 2
push edx
push 0x40309c
call fcn.00402560
add esp, 8
mov eax, dword [ebp - 0x1c]
and eax, 1
je 0x4024cf
movzx ecx, word [ebp - 0x18]
mov dword [ebp - 0x54], ecx
jmp 0x4024d6
mov dword [ebp - 0x54], 0xa
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x40368c]
push ecx
mov edx, dword [0x403688]
push edx
call fcn.004025a0
add esp, 8
mov eax, dword [0x403688]
push eax
call fcn.00402420
add esp, 4
mov ecx, 0x4030b0
sub ecx, 0x4030ac
sar ecx, 2
push ecx
push 0x4030ac
call fcn.00402560
add esp, 8
mov edx, 0x4030b8
sub edx, 0x4030b4
sar edx, 2
push edx
push 0x4030b4
call fcn.00402560
add esp, 8
call fcn.004025d0
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100cbdb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.0100c8ef
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x100cbfd
mov eax, 0x80070057
jmp 0x100ccdd
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x80070057
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x100ccd9
cmp dword [ebp - 8], 1
je 0x100cc41
cmp dword [ebp - 8], 2
je 0x100cc41
cmp dword [ebp - 8], 7
jne 0x100ccd9
shr dword [ebp - 4], 1
test byte [esi + 8], 0x20
je 0x100cc83
mov eax, dword [esi + 4]
cmp dword [ebp - 4], eax
jb 0x100cc55
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, dword [esi + 4]
cmp ecx, ebx
jle 0x100cc7d
mov edx, dword [esi]
xor edi, edi
mov word [edx + ecx*2 - 2], di
cmp eax, ebx
jne 0x100ccd9
jmp 0x100ccc4
push dword [ebp - 4]
mov ecx, esi
call fcn.0100c694
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100ccd9
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, esi
test eax, eax
je 0x100ccbc
lea eax, [ebp - 0x10]
push eax
call fcn.0100c6c0
jmp 0x100ccd9
push dword [ebp - 0x10]
call fcn.0100c99f
cmp dword [ebp - 8], 2
je 0x100cccf
mov dword [ebp - 0xc], ebx
jmp 0x100ccd9
mov ecx, esi
call fcn.0100cb1d
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x405a80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e568]
jne 0x405a8a
repz ret
jmp fcn.00407a6b

Function at 0x4064db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e568]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404844
and dword [ebp - 0x14], 0
cmp dword [0x420570], 0
mov dword [ebp - 0x18], eax
jne 0x40658e
push 0x401e08
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406636
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401dfc
push ebx
call edi
test eax, eax
je 0x406636
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x401dec
push ebx
mov dword [0x420570], eax
call edi
push eax
call esi
push 0x401dd8
push ebx
mov dword [0x420574], eax
call edi
push eax
call esi
push 0x401dbc
push ebx
mov dword [0x420578], eax
call edi
push eax
call esi
mov dword [0x420580], eax
test eax, eax
je 0x40658e
push 0x401da4
push ebx
call edi
push eax
call esi
mov dword [0x42057c], eax
mov eax, dword [0x42057c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4065e7
cmp dword [0x420580], ecx
je 0x4065e7
push eax
call esi
push dword [0x420580]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4065e7
test ebx, ebx
je 0x4065e7
call edi
test eax, eax
je 0x4065de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4065de
test byte [ebp - 8], 1
jne 0x4065e7
or dword [ebp + 0x10], 0x200000
jmp 0x40661a
mov eax, dword [0x420574]
cmp eax, dword [ebp - 0x18]
je 0x40661a
push eax
call esi
test eax, eax
je 0x40661a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40661a
mov eax, dword [0x420578]
cmp eax, dword [ebp - 0x18]
je 0x40661a
push eax
call esi
test eax, eax
je 0x40661a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420570]
call esi
test eax, eax
je 0x406636
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406638
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a80
leave
ret
Function at 0x41a510
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0x7a4614], 0x37
jne 0x41a5c9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x4029bc
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 4]
push ecx
push 0x4029d0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402a04
push 0x402a10
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea edx, [esp + 0x810]
push edx
push 0
push 0x402a68
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov eax, dword [0x7a5608]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x425664]
mov byte [eax + esi], dl
add esp, 0xc0c
ret