joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1247ab0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x1247c54
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x1247c4d
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x1247b3b
add ebp, dword [esp + 4]
mov eax, edi
mov esi, 0x80078071
mul esi
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul esi
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov esi, dword [esp + 8]
sub esi, dword [esp]
mov edx, 0x15b0
je 0x1247c4d
mov dword [esp + 8], esi
xor esi, esi
cmp edx, 8
mov dword [esp], edx
jb 0x1247bc8
mov esi, edx
and esi, 0x1ff8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov ebx, edi
and ebx, eax
xor edi, eax
lea edi, [edi + ebx*2]
mov eax, edi
and eax, ecx
xor ecx, edi
movzx ebx, byte [ebp + edx + 1]
add ebx, edi
movzx edi, byte [ebp + edx + 2]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + eax*2]
movzx eax, byte [ebp + edx + 3]
add eax, edi
add ecx, edi
movzx edi, byte [ebp + edx + 4]
add edi, eax
add ecx, eax
movzx eax, byte [ebp + edx + 5]
add eax, edi
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, eax
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, ebx
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x1247b60
add ebp, eax
mov eax, edx
sub eax, esi
jbe 0x1247b04
mov dword [esp + 4], eax
mov eax, esi
or eax, 1
test dl, 1
jne 0x1247bf0
mov ebx, ebp
cmp edx, eax
je 0x1247b00
jmp 0x1247c0f
lea ebx, [ebp + 1]
movzx esi, byte [ebp]
mov edx, edi
and edx, esi
xor edi, esi
lea edi, [edi + edx*2]
mov edx, dword [esp]
add ecx, edi
mov esi, eax
cmp edx, eax
je 0x1247b00
mov eax, dword [esp]
sub eax, esi
mov dword [esp + 0xc], eax
xor esi, esi
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + esi]
mov eax, edi
and eax, edx
xor edi, edx
lea eax, [edi + eax*2]
add ecx, eax
movzx edx, byte [ebx + esi + 1]
mov edi, eax
and edi, edx
xor eax, edx
lea edi, [eax + edi*2]
add ecx, edi
add esi, 2
cmp dword [esp + 0xc], esi
jne 0x1247c20
jmp 0x1247b00
shl ecx, 0x10
or ecx, edi
jmp 0x1247c59
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x125eab0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x125ead0
sar edi, 1
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x125eaf0
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x125eb0e
mov eax, 0xffffffff
jmp 0x125eb17
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0124d720
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x125eb41
add esi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x125eb30
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x125eb71
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x125eb60
mov word [ebx], 0
lea ecx, [esp + 0xc]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x24], eax
push eax
call fcn.0128b9e0
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x1291bfc]
Function at 0x1280c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x1280c80
lea ecx, [edi + eax]
add ecx, 0xfffffffe
mov ebx, edi
not ebx
and ebx, ecx
add eax, edi
mov ebp, 1
sub ebp, eax
and ebp, edi
mov dword [esp + 4], 0x5e5a5cd1
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x1280ce6
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.01284c30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x1280cc0
cmp ebx, ebp
je 0x1280d5e
sub ebx, ebp
sar ebx, 1
mov eax, dword [esp + 4]
lea ecx, [ebx - 1]
mov edx, ebx
and edx, 3
je 0x1280d26
mov dword [esp + 8], ecx
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edi]
xor esi, ecx
imul esi, eax
add edi, 2
inc ebp
cmp edx, ebp
jne 0x1280d10
sub ebx, ebp
mov ecx, dword [esp + 8]
cmp ecx, 3
jb 0x1280d5e
xor ecx, ecx
nop
nop
nop
movzx edx, word [edi + ecx*2]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 2]
xor esi, edx
imul esi, eax
movzx edx, word [edi + ecx*2 + 4]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 6]
xor esi, edx
imul esi, eax
add ecx, 4
cmp ebx, ecx
jne 0x1280d30
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401670
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x40b5cc
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x401760
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x401775
cmp eax, 0xffffffff
je 0x401775
call fcn.004017e0
mov eax, dword [esp + 0xc]
push 0
test eax, eax
je 0x401783
push 1
jmp 0x401785
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x4017d0
mov ecx, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 8]
push 4
push edx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x1c], ecx
call edi
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call edi
pop edi
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, 0xffffffff
pop esi
setne al
pop ecx
ret 8

Function at 0x401810
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
mov dword [ecx], eax
test esi, esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jne 0x401837
push 0xffffffffffffffff
call dword [sym.imp.WS2_32.dll_htonl]
jmp 0x401873
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401867
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push edi
lea edi, [ebx + 4]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
pop edi
mov word [ebx], ax
jmp 0x40187b
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x401892
mov dword [ebx + 4], eax
mov word [ebx], 2
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 2], ax
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4018a0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4018b9
mov eax, dword [esi + 8]
test eax, eax
je 0x4018b9
call fcn.004017e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
lea edx, [esp + 8]
push ecx
push edx
mov dword [esi + 8], 0
call fcn.00401810
add esp, 0xc
test eax, eax
je 0x4018f4
mov ecx, dword [esi + 4]
lea eax, [esp + 4]
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 8

Function at 0x401930
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x401952
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x401956
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40195d
mov dword [esi + 8], eax
pop esi
ret 8
Function at 0x401ed0
Capabilities:
Read data from internet
Receive data

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 0xc]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x401ef3
or eax, 0xffffffff
ret 8
mov eax, dword [esp + 8]
ret 8

Function at 0x402c40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x40d164
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402cab
push ebx
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x402c73
mov ecx, dword [edi]
push 0
push ecx
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ebx, eax
test edi, edi
je 0x402c9b
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov dword [edi], eax
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4044a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push ebx
push ecx
push 0
push edx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x4044f0
mov ecx, dword [edi + 8]
mov edx, dword [ebx]
push eax
push ecx
push edx
call fcn.00402850
add esp, 0xc
mov dword [ebx], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x404500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
test edi, edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x400
je 0x404527
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push ebp
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test edi, edi
mov ebx, eax
je 0x404553
mov edx, dword [esp + 0x10]
mov dword [edi], edx
test ebx, ebx
jne 0x40456f
mov eax, dword [esi + 8]
test eax, eax
je 0x40456f
mov eax, dword [edi]
mov cl, byte [esi + 8]
push eax
push ecx
push ebx
push ebp
call fcn.004028d0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x404580
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
push 0
mov eax, dword [esi + 8]
push eax
push ecx
call fcn.00402850
mov ecx, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
push 4
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x4045c0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 8]
test eax, eax
je 0x4045dd
push 0
push eax
push 1
push edi
call fcn.004028d0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
inc eax
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x404600
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
test ebx, ebx
mov dword [esp + 0x10], 0x94
mov ebp, 0x63
je 0x40464f
mov edi, 0x40d2f8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40476b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp ecx, 4
jne 0x4046b9
test edx, edx
jne 0x404697
cmp eax, 2
je 0x404713
test ebx, ebx
mov ebp, 0xa
je 0x40476b
mov edi, 0x40d2f0
jmp 0x404722
cmp edx, 0x5a
jne 0x4046be
mov eax, dword [esp + 0x20]
cmp eax, 2
je 0x404713
test ebx, ebx
mov ebp, 0xc
je 0x40476b
mov edi, 0x40d2e8
jmp 0x404722
cmp ecx, 4
jb 0x4046db
test edx, edx
jbe 0x4046db
cmp eax, 2
je 0x4046db
test ebx, ebx
mov ebp, 0xb
je 0x40476b
mov edi, 0x40d2e0
jmp 0x404722
cmp ecx, 5
jne 0x404713
test edx, edx
jne 0x4046f9
cmp eax, 2
jne 0x404713
test ebx, ebx
mov ebp, 0x15
je 0x40476b
mov edi, 0x40d2d8
jmp 0x404722
cmp edx, 1
jne 0x404713
cmp eax, 2
jne 0x404713
test ebx, ebx
mov ebp, 0x16
je 0x40476b
mov edi, 0x40d2d0
jmp 0x404722
test eax, eax
jne 0x40473f
xor ebp, ebp
test ebx, ebx
je 0x40476b
mov edi, 0x40d2c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x40476b
mov ecx, dword [esp + 0x1c]
mov edi, ebx
push ecx
or ecx, 0xffffffff
xor eax, eax
push edx
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
not ecx
dec ecx
push edx
add ecx, ebx
push 0x40d2bc
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x405000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x406700
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebx
push esi
push edi
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
call fcn.00404600
add esp, 4
cmp eax, 0x14
lea edx, [esp + 0xc]
jl 0x406763
mov edi, 0x40de4c
or ecx, 0xffffffff
xor eax, eax
push 0x40d4af
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__strlwr]
jmp 0x406798
mov edi, 0x40de40
or ecx, 0xffffffff
xor eax, eax
push 0x40d4af
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0x40d4af
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00405000
add esp, 4
test eax, eax
pop edi
pop esi
pop ebx
jne 0x406801
push eax
push 1
lea ecx, [esp + 8]
push 1
push ecx
push eax
call fcn.004054f0
add esp, 0x14
test eax, eax
je 0x40680e
lea edx, [esp]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x100
ret
Function at 0x409200
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40a53b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebp
push esi
lea ecx, [esp + 8]
call fcn.00404310
xor esi, esi
lea ecx, [esp + 8]
push esi
push esi
push 0xf003f
push esi
push esi
push 0x40d565
push 0x80000002
mov dword [esp + 0x17c], esi
xor ebp, ebp
call fcn.00404400
test eax, eax
jne 0x4092c4
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
lea eax, [esp + 0x20]
push 0x40de88
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x60]
push 0
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00404500
test eax, eax
jne 0x4092b3
push eax
push eax
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00404e80
add esp, 0x10
test eax, eax
jne 0x4092b3
push 5
push eax
lea ecx, [esp + 0x68]
push eax
push ecx
push 0x40d404
push eax
call edi
cmp eax, 0x20
jle 0x4092b3
inc ebp
inc esi
cmp esi, 9
jle 0x40925f
lea ecx, [esp + 0x10]
call fcn.004043e0
pop edi
pop ebx
lea ecx, [esp + 8]
mov dword [esp + 0x160], 0xffffffff
call fcn.00404350
mov ecx, dword [esp + 0x158]
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x15c
ret
Function at 0x409e20
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x409ecb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e244
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e23c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x409eb5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4b9510]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x274], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x264], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 4]
mov dword [0x4bb3c8], eax
cmp dword [0x4bb3c8], 0
jne 0x40105f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xb3c
push 0
push 0x4ba850
call fcn.00493180
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x260], cx
push 0x256
push 0
lea edx, [ebp - 0x25e]
push edx
call fcn.00493180
add esp, 0xc
mov eax, dword [0x4bb3c8]
push eax
push 0x4a6368
push 0x12c
lea ecx, [ebp - 0x260]
push ecx
call fcn.004930ae
add esp, 0x10
mov dword [ebp - 0x278], 0xb3c
lea edx, [ebp - 0x278]
push edx
push 0x4ba850
push 0
push 8
mov eax, dword [0x4bb3c8]
push eax
lea ecx, [ebp - 0x260]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4010ef
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4ba93a
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x4bb3dc], eax
cmp dword [0x4bb3dc], 0
jne 0x401117
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [0x4bb3dc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4bb3dc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4bb3e4]
push ecx
call fcn.0040a0b0
add esp, 4
test eax, eax
jne 0x40114b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4ba850
push 1
push 0
call dword [0x4bc8e4]
mov dword [0x4bb3cc], eax
cmp dword [0x4bb3cc], 0
jne 0x401170
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4ba89e
push 0
push 1
push 0
call dword [0x4bc908]
mov dword [0x4bb3d0], eax
cmp dword [0x4bb3d0], 0
jne 0x401197
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4ba8ec
push 0
push 0x100000
call dword [0x4bc8d8]
mov dword [0x4bb3d8], eax
cmp dword [0x4bb3d8], 0
jne 0x4011bf
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x401250
push 0
push 0
call dword [0x4bc948]
mov dword [0x4bb3d4], eax
cmp dword [0x4bb3d4], 0
jne 0x4011ea
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [0x4bb3d8]
mov dword [ebp - 0x270], edx
mov eax, dword [0x4bb3d0]
mov dword [ebp - 0x26c], eax
mov ecx, dword [0x4bb3d4]
mov dword [ebp - 0x268], ecx
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x270]
push edx
push 3
call dword [0x4bc960]
push 0xffffffffffffffff
mov eax, dword [0x4bb3d4]
push eax
call dword [0x4bc918]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4b9510]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x140], str.ENCWCHAR_SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
lea eax, [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x14c], 0
jmp 0x401b44
mov ecx, dword [ebp - 0x14c]
add ecx, 1
mov dword [ebp - 0x14c], ecx
cmp dword [ebp - 0x14c], 1
jae 0x401b83
push 0x96
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp + edx*4 - 0x13c]
push eax
push 0
push 8
mov ecx, dword [0x4bb3e8]
push ecx
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp + edx*4 - 0x140]
push eax
call fcn.0040b370
add esp, 0x18
jmp 0x401b35
mov dword [ebp - 0x144], 0xfffe
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x401bee
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x148]
push edx
push 0
push 0x10000002
push 0x4a64bc
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x401be1
mov eax, dword [ebp - 0x148]
jmp 0x401bf0
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004931fa
mov esp, ebp
pop ebp
ret