joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b61d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.009b6217
loopne 0x9b623a
mov dh, 0xf6
aaa
pop esp
push 0xffffffffffffffe0
push edi
mov ch, 0x26
pushfd
xor al, cl
jns 0x9b6245
pop ebx
inc ecx
mov dword [esi + reloc.MSVCRT.dll_strncpy], ebx
mov ebp, 0
mov dl, cl
mov dx, word [esp]
jmp 0x9b628e
jmp 0x9b62a1
bswap edx
rdtsc
sub esp, 0x13
jne 0x9b6278
je 0x9b62da
invalid
mov word [esp + 0x10], bx
lea esp, [esp]
lea esp, [esp + 3]
jmp 0x9b62e8
call fcn.009b6320
xchg edx, ebx
jmp 0x9b630a
mov word [esp + 0x10], bx
lea esp, [esp]
lea esp, [esp + 3]
jmp 0x9b62ad
sub esi, 8
sub esp, 1
jo 0x9b62af
jno 0x9b62af
stosd dword es:[edi], eax
lea esp, reloc.MSVCRT.dll_strncpy
fst dword [ebx - 0x22]
sub dword [eax - 0x15], ecx
push ecx
jmp 0x9b636f
js 0x9b633d
mov bx, 0x8193
bswap ebx
jmp 0x9b634d
mov bx, 0x8193
bswap ebx
lea esp, [esp + 1]
jmp 0x9b6392
lea esp, [esp + 1]
jmp 0x9b6392
xchg ebx, eax
neg al
jmp fcn.00978853
mov ecx, esi
mov dword [ecx], ebx
pop ecx
mov bx, bp
sub esp, 0x19
jmp 0x9b6327
xchg ebx, eax
neg al
jmp fcn.00978853
mov dword [esi + 4], eax
lea ebx, [edx*4]
bsr ebx, ebp
jge 0x9b6353
jl 0x9b637c
bsr eax, eax
not ch
mov eax, 0x1ec6b4d0
jmp 0x9b63c4
mov ebx, dword [esi]
lea eax, reloc.MSVCRT.dll_strncpy
mov cx, word [esp]
bswap eax
jmp 0x9b654c
add esi, 4
call fcn.009b6443
lea esp, [esp + 2]
push dword [esp + 0x48]
ret 0x4c
Function at 0x40102c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
push esi
push edi
mov esi, 0x40c500
push esi
call ebx
cmp eax, 0x104
ja 0x40118f
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x10]
push 0x5c
pop edx
cmp cx, 0x61
jb 0x40106e
cmp cx, 0x7a
jbe 0x401077
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x40108a
cmp word [esp + 0x12], 0x3a
jne 0x40108a
cmp word [esp + 0x14], dx
jne 0x40108a
push 3
jmp 0x4010a0
cmp cx, dx
jne 0x40118f
cmp word [esp + 0x12], dx
jne 0x40118f
push 2
pop ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4010c3
test al, 0x10
mov eax, 0xb7
push 0
pop ecx
cmovne eax, ecx
jmp 0x401192
lea ecx, [esp + 0x10]
call fcn.00401deb
mov esi, eax
test esi, esi
je 0x401170
cmp esi, 0xb7
je 0x401170
lea eax, [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00401fca
test eax, eax
js 0x40118b
cmp eax, ebp
jb 0x40118b
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x401136
cmp edi, 1
je 0x401170
mov edi, eax
jmp 0x40112f
lea ecx, [esp + 0x10]
cmp esi, 0xb7
je 0x401174
call fcn.00401fca
test eax, eax
js 0x40118b
je 0x40118b
cmp eax, ebp
jb 0x40118b
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
lea ecx, [esp + 0x10]
call fcn.00401deb
mov esi, eax
test esi, esi
jne 0x401114
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, edi
jae 0x401170
push 0x5c
pop esi
lea ecx, [esp + 0x10]
mov word [esp + eax*2 + 0x10], si
call fcn.00401deb
test eax, eax
jne 0x401192
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, edi
jb 0x401153
xor eax, eax
jmp 0x401192
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401145
test al, 0x10
jne 0x401145
mov eax, 0xb7
jmp 0x401192
mov eax, esi
jmp 0x401192
push 0x7b
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x4013b5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x2dc
mov eax, dword [0x40c960]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x14], ebx
test eax, eax
jne 0x401439
push 0x106
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4014d1
cmp eax, 0x104
ja 0x4014d1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [esp + eax*2 + 0x1a], cx
je 0x40140e
mov word [esp + eax*2 + 0x1c], cx
inc eax
lea ecx, [esp + 0x1c]
push 0x40a4d8
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x40c960], eax
test eax, eax
je 0x4014d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeW
push eax
call esi
push str.GetFileVersionInfoW
push dword [0x40c960]
mov dword [esp + 0x18], eax
call esi
push str.VerQueryValueW
push dword [0x40c960]
mov ebp, eax
call esi
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x4014d1
test ebp, ebp
je 0x4014d1
test eax, eax
je 0x4014d1
push edi
push ebx
call ecx
mov ebx, eax
test ebx, ebx
je 0x4014d1
push ebx
call sub.msvcrt.dll_malloc
mov esi, eax
pop ecx
test esi, esi
je 0x4014d1
push esi
push ebx
push edi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x4014c6
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edi
push eax
push 0x40a52c
push esi
call dword [esp + 0x28]
test eax, eax
je 0x4014c6
mov eax, dword [esp + 0x10]
mov edi, dword [eax + 8]
push esi
call sub.msvcrt.dll_free
pop ecx
mov eax, edi
jmp 0x4014d3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x401e91
Capabilities:
Set registry value

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 4

Function at 0x402074
Capabilities:
Create shortcut via ishelllink
Delete file
Get common file path

Disassembly:
sub esp, 0x4c0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
xor esi, esi
xor eax, eax
xor ebp, ebp
mov word [esp + 0x20], ax
inc ebp
lea eax, [esp + 0x20]
cmp esi, ebp
push eax
push 0
push 0
push 2
pop eax
push 0x17
pop edx
cmove eax, edx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4021d7
lea ecx, [esp + 0x20]
call fcn.00401ebe
mov edx, 0x40a20c
lea ecx, [esp + 0x20]
call fcn.00401000
test esi, esi
je 0x4020d6
lea ecx, [esp + 0x20]
call fcn.00401deb
lea ecx, [esp + 0x20]
call fcn.00401ebe
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
lea eax, [esp + eax*2 + 0x20]
mov dword [esp + 0x18], eax
mov ecx, str.7_Zip_Help.lnk
test ebx, ebx
mov edx, str.7_Zip_File_Manager.lnk
cmovne edx, ecx
mov ecx, eax
call fcn.00401019
push 0x40c500
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, str.7_zip.chm
lea ecx, [esp + 0x278]
test ebx, ebx
mov edx, str.7zFM.exe
cmovne edx, eax
call fcn.00401000
test esi, esi
jne 0x402149
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4021c1
lea eax, [esp + 0x10]
push eax
push 0x40ac24
push 1
push 0
push 0x40ac44
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x4021ba
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x278]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x40ac34
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
test edi, edi
js 0x4021b0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
test edi, edi
cmovne ebp, eax
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, 2
jb 0x4020f4
test esi, esi
je 0x4021d7
test ebp, ebp
jne 0x4021e5
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, 3
jb 0x402084
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c0
ret
Function at 0x4050eb
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov ebp, ecx
mov esi, dword [edi]
and dword [edi], 0
test esi, esi
je 0x405135
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0
push eax
mov ecx, 0x400000
mov eax, esi
cmp esi, ecx
cmova eax, ecx
push eax
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x40513e
test ecx, ecx
jne 0x4050fc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405137

Function at 0x4051b7
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov ebp, ecx
mov esi, dword [edi]
and dword [edi], 0
test esi, esi
je 0x405201
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0
push eax
mov ecx, 0x400000
mov eax, esi
cmp esi, ecx
cmova eax, ecx
push eax
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x40520a
test ecx, ecx
jne 0x4051c8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405203

Function at 0x405e8b
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x405eca
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405eca
push 0xc00
call eax
test eax, eax
jne 0x405f66
push 0x106
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405f66
cmp eax, 0x104
ja 0x405f66
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d2], cx
je 0x405f01
mov word [ebp + eax*2 - 0x2d0], cx
inc eax
mov cl, byte [str.userenv]
push esi
mov esi, str.userenv
test cl, cl
je 0x405f65
push ebx
push edi
lea edi, [ebp - 0x2d0]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov edx, edi
inc esi
movzx eax, cl
mov cl, byte [esi]
inc esi
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x405f22
push 0x2e
pop eax
push 0x64
mov word [edx], ax
pop eax
mov word [edx + 2], ax
xor eax, eax
push 8
push eax
mov word [edx + 8], ax
lea eax, [ebp - 0x2d0]
push eax
mov word [edx + 4], bx
mov word [edx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov cl, byte [esi]
test cl, cl
jne 0x405f1f
pop edi
pop ebx
pop esi
leave
ret

Function at 0x407686
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov edx, ecx
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x40768e
mov dword [ecx*4 + 0x40c980], edx
inc ecx
cmp ecx, 0x100
jb 0x407689
pop esi
mov edx, 0x400
mov ecx, dword [edx + 0x40c580]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x40c980]
mov dword [edx + 0x40c980], ecx
add edx, 4
cmp edx, 0x3000
jb 0x4076b9
ret
Function at 0x407e73
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407eb2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407eb2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407eb2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407eb2
cmp dword [ecx + 0x74], 0xe
jbe 0x407eb2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408550
Capabilities:
Get process heap force flags

Disassembly:
call fcn.00408480
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x40857a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x408586
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x408590
Capabilities:
Get process heap force flags

Disassembly:
call fcn.00408480
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x4085ba
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x408980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004089b0
mov esi, dword [ebp + 8]
test al, al
je 0x40899e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.004089c0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x408af0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408b4c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408b4c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408b4c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408b4c
cmp dword [ecx + 0x74], 0xe
jbe 0x408b4c
cmp dword [ecx + 0xe8], 0
je 0x408b4c
push dword [ebp + 8]
call fcn.004089c0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40fd00
call fcn.00408790
add esp, 8
cmp dword [ebp - 8], 0
jne 0x408b81
push dword [ebp + 8]
call fcn.00408980
mov esp, ebp
pop ebp
ret

Function at 0x408bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408c1c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408c1c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408c1c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408c1c
cmp dword [ecx + 0x74], 0xe
jbe 0x408c1c
cmp dword [ecx + 0xe8], 0
je 0x408c1c
push dword [ebp + 8]
call fcn.004089c0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40fd00
call fcn.00408790
add esp, 8
cmp dword [ebp - 8], 0
jne 0x408c51
push dword [ebp + 8]
call fcn.00408980
mov esp, ebp
pop ebp
ret
Function at 0x408e00
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x408e2a
mov eax, 2
pop ebp
ret
push esi
call fcn.00408480
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x408e4a
jmp dword [eax*4 + 0x408e80]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.00409480
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x4094b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x40c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4094d7
mov ecx, 5
int 0x29
push 2
call fcn.00407f17
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4095e2
test esi, esi
jne 0x4095e2
push 2
call fcn.00407f17
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004081a5
mov esp, ebp
pop ebp
ret

Function at 0x409990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4099bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4099bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x409c70
test edx, 3
je 0x409b02
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x409ae7
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x409b10
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x409c69
xor eax, dword [edi + edx]
jmp 0x409c37
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x409c87
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x409c74
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4035f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push str.SOFTWARESangforSSLSangforCSClient
mov esi, ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403646
push eax
push str.SOFTWARESangforSSLSangforCSClient
push str.RegOpenKeyEx_failed__key___s__err___d
call fcn.00411930
add esp, 0xc
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.RememberPassword
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403693
push eax
push str.RememberPassword
push str.RegQueryValueEx_failed__key___s__err___d
call fcn.00411930
mov eax, dword [esp + 0x10]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0xc]
xor eax, eax
cmp edx, 1
push 0
sete al
mov dword [esi + 0x1d8], eax
mov dword [0x44f5b4], eax
mov ecx, dword [esi + 0x1d8]
mov edx, dword [esi + 0x114]
push ecx
push 0xf1
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x44fbd0]
test eax, eax
je 0x4036db
push 0
lea ecx, [esi + 0xf4]
call sub.MFC42.DLL_CWnd::EnableWindow
mov eax, dword [0x44fbdc]
test eax, eax
je 0x4036f5
mov eax, dword [esi + 0x1d8]
test eax, eax
je 0x4036f5
mov ecx, esi
call fcn.00403720
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0xc
ret
Function at 0x406100
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x224
push ebx
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
mov byte [esp + 0x20], al
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x238]
lea ecx, [esp + 0x128]
push eax
push str.SOFTWARESangforSSLRunApp_
push 0x446820
xor ebx, ebx
xor esi, esi
push 0x104
push ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edx, [esp + 0x14]
lea eax, [esp + 0x128]
push edx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40623a
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
push str.Path
push ecx
mov dword [esp + 0x24], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406227
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x406227
mov edx, dword [esp + 0x18]
inc edx
push edx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x240]
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [edx], edi
je 0x406227
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], 1
lea ecx, [eax + 1]
xor eax, eax
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x4062f4
mov ecx, dword [esp + 0x234]
lea edx, [esp + 0x1c]
push ebp
lea eax, [esp + 0x10]
push edx
push eax
push str.app_path
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
call fcn.004200c0
add esp, 0x10
cmp eax, 1
jne 0x4062e2
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4062e6
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
lea ebx, [esi + esi]
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4062de
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00407380
add esp, 0x10
test eax, eax
jle 0x4062de
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0x14]
mov dword [ecx], ebp
jmp 0x4062e6
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test edx, edx
pop ebp
je 0x4062f4
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x224
ret 0xc