joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fd000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016de18
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [eax]
xor edi, edi
test eax, eax
je 0x100fd170
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push eax
call esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x64]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
push str.RegCloseKey
push dword [eax]
call esi
mov esi, eax
cmp dword [ebp - 0x58], edi
je 0x100fd170
cmp dword [ebp - 0x68], edi
je 0x100fd170
test esi, esi
je 0x100fd170
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x3c], 0x620079
mov dword [ebp - 0x38], 0x61006f
mov dword [ebp - 0x34], 0x640072
mov dword [ebp - 0x30], 0x4c0020
mov dword [ebp - 0x2c], 0x790061
mov dword [ebp - 0x28], 0x75006f
mov dword [ebp - 0x24], 0x5c0074
mov dword [ebp - 0x20], 0x720050
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x61006f
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x60], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], edi
push eax
push 0x20019
lea ecx, [ebp - 0x60]
call fcn.100920b0
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x100fd146
mov dword [ebp - 0x44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 0x1018ad38
push dword [ebp - 0x5c]
movups xmmword [ebp - 0x54], xmm0
call dword [ebp - 0x68]
test eax, eax
jne 0x100fd141
push 0x10
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1012d76b
add esp, 0xc
mov edi, eax
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x60]
call fcn.100922b0
test edi, edi
je 0x100fd15d
mov ecx, dword [ebp - 0x64]
push edi
call fcn.100fd190
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.100922b0
mov eax, edi
jmp 0x100fd172
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret
Function at 0x100fd190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016de50
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x100fd3a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push str.RegCloseKey
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x100fd3a7
cmp dword [ebp - 0x84], 0
je 0x100fd3a7
test esi, esi
je 0x100fd3a7
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.100920b0
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x100fd398
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.10076da0
add esp, 0xc
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x60], 0x14
cmovae eax, dword [ebp - 0x78]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x7c]
movups xmmword [ebp - 0x5c], xmm0
call dword [ebp - 0x84]
test eax, eax
jne 0x100fd345
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.1012d76b
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x100fd384
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100fd37a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100fd3c6
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.100922b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret 4
call fcn.10129e39
int3
Function at 0x100fd3d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x101b900c]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.10121fd0
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100fd42c
cmp dword [esp + 4], 6
jb 0x100fd42c
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.10109ef1
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.10109ef1
add esp, 0x118
ret
Function at 0x100fdf40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x101b900c]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x244]
test ebx, ebx
je 0x100fe08b
mov eax, dword [ecx]
test eax, eax
je 0x100fe08b
push edi
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100fe08a
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call fcn.10121fd0
add esp, 0xc
mov dword [esp + 0x10], 0x208
cmp dword [esi + 0x14], 8
jb 0x100fdfb9
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
call edi
lea eax, [esp + 0x34]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100fdfd2
sub eax, edx
lea ecx, [ebp + 0x38]
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10003600
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push ebx
call edi
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100fe014
sub ecx, edx
lea eax, [esp + 0x34]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x50]
call fcn.10003600
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push ebx
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call edi
pop edi
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10109ef1
add esp, 0x230
ret 0xc
Function at 0x100ff1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016e298
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.10109f02
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.10121fd0
add esp, 0x10
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100ff254
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.1007c660
test al, al
je 0x100ff281
lea ecx, [ebp - 0x14]
call fcn.1007b670
test al, al
jne 0x100ff281
xor bl, bl
jmp 0x100ff31f
lea esi, [edi + 4]
xor ecx, ecx
mov edx, esi
call fcn.10085e90
test al, al
jne 0x100ff2a5
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100ff2a0
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x1c]
mov ecx, 0x1a
mov edx, esi
call fcn.10085e90
test al, al
jne 0x100ff2cc
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100ff2c7
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x34]
mov ecx, 2
mov edx, esi
call fcn.10085e90
test al, al
jne 0x100ff2f3
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100ff2ee
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x4c]
mov ecx, 0xb
mov edx, esi
call fcn.10085e90
test al, al
jne 0x100ff31a
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100ff315
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov byte [edi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1007ada0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret
Function at 0x100ff3d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016e2e1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x101b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edx, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x100ff414
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100ff42e
mov eax, edx
nop dword [eax]
cmp word [eax], 0x25
je 0x100ff463
add eax, 2
sub ecx, 1
jne 0x100ff420
push esi
mov ecx, edi
call fcn.10026480
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ef1
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x100ff42e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x100ff42e
push esi
lea ecx, [ebp - 0x28]
call fcn.10026480
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100ff48a
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x100ff502
push esi
mov ecx, edi
call fcn.10026480
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100ff4e9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100ff4df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ff5c2
push edx
push ecx
call fcn.1010a295
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x100ff444
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1010a31b
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x100ff529
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x100ff569
cmp eax, dword [ebp - 0x34]
ja 0x100ff569
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ff550
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10003600
push esi
call fcn.1010a316
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
add esp, 4
mov dword [edi + 0x14], 0
xor eax, eax
movups xmmword [edi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x100ff444
call fcn.10129e39
int3
Function at 0x101078a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016ee0c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101b900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.10003590
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.10003590
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.10003590
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.10003590
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10003590
push 0x88
push ebx
call fcn.1010a295
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1010ca82
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1013d15a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1013cfd9

Function at 0x1013f526
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1013f1e6
Function at 0x410823
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4285f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0041195b
test eax, eax
je 0x4108a9
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x6e
push dword [0x42d664]
call dword [sym.imp.USER32.dll_LoadStringW]
xor esi, esi
test eax, eax
jle 0x410879
push 0x30
push esi
lea eax, [ebp - 0x404]
push eax
push dword [0x42d64c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x428038], 5
jbe 0x4108f9
push 0x2000
push esi
mov edi, 0x428038
push edi
call fcn.0040d55b
test al, al
je 0x4108f9
lea eax, [ebp - 0x424]
push eax
push 2
push esi
push esi
push 0x40cd2d
jmp 0x4108f3
push 5
xor esi, esi
push esi
push esi
push 0x401cb8
push 0x401d14
push dword [0x42d64c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x428038], 5
jbe 0x4108f9
push 0x2000
push esi
mov edi, 0x428038
push edi
call fcn.0040d55b
test al, al
je 0x4108f9
lea eax, [ebp - 0x424]
push eax
push 2
push esi
push esi
push 0x40cd54
push edi
call fcn.0040d59b
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004151b0
leave
ret

Function at 0x4131cc
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x720
mov eax, dword [0x4285f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x718], ecx
lea ecx, [ebp - 0x304]
push 0x100
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x304]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x413328
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x304]
push edi
push esi
push dword [ebp - 0x714]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x413320
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x71c]
push eax
push 0x4026f4
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x71c]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x104]
push 0x402728
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
add esp, 0x10
cmp dword [ebp + 0x14], esi
jle 0x413320
lea eax, [ebp - 0x708]
mov dword [ebp - 0x70c], 0x200
mov dword [ebp - 0x710], eax
lea ecx, [ebp - 0x710]
lea eax, [ebp - 0x104]
push eax
call fcn.00415a66
mov eax, dword [ebp - 0x718]
lea ecx, [ebp - 0x710]
push dword [eax + esi*8]
call fcn.00415a66
mov eax, dword [ebp - 0x710]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x708]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
mov eax, dword [ebp - 0x718]
je 0x413306
push dword [ebp - 0x720]
jmp 0x41330b
push 0x40275c
push dword [eax + esi*8 + 4]
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
inc esi
cmp esi, dword [ebp + 0x14]
jl 0x413292
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004151b0
leave
ret 0x10
Function at 0x414d3a
Capabilities:
Terminate process

Disassembly:
call fcn.004ca000
jmp 0x414d3a
push 0x58
push 0x426768
call fcn.004155f8
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x42db24
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x414d8c
cmp eax, esi
jne 0x414d7f
xor esi, esi
inc esi
mov edi, esi
jmp 0x414d8f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x414d63
xor esi, esi
inc esi
cmp dword [0x42db28], esi
jne 0x414da1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x414ddb
cmp dword [0x42db28], ebx
jne 0x414dd5
mov dword [0x42db28], esi
push 0x40101c
push 0x401010
call fcn.00414f19
pop ecx
pop ecx
test eax, eax
je 0x414ddb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x414f09
mov dword [0x42d78c], esi
cmp dword [0x42db28], esi
jne 0x414dfe
push 0x40100c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x42db28], 2
test edi, edi
jne 0x414e0b
xor eax, eax
mov ecx, 0x42db24
xchg dword [ecx], eax
cmp dword [0x42db2c], 0
je 0x414e37
push 0x42db2c
call fcn.00415450
pop ecx
test eax, eax
je 0x414e37
push ebx
push 2
push ebx
mov esi, dword [0x42db2c]
mov ecx, esi
call dword [0x42e3f4]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x414e95
test cl, cl
je 0x414e64
test edi, edi
jne 0x414e95
test cl, cl
je 0x414e64
cmp cl, 0x20
ja 0x414e64
inc esi
mov dword [ebp - 0x1c], esi
mov cl, byte [esi]
jmp 0x414e53
test byte [ebp - 0x3c], 1
je 0x414e70
movzx eax, word [ebp - 0x38]
jmp 0x414e73
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x42d788], eax
cmp dword [0x42d7a0], 0
jne 0x414eee
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x414ea6
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x414eb9
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x414e44
cmp dword [0x42d78c], 0
jne 0x414f02
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x42d788]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415334
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x426788
call fcn.004155f8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x415394
cmp eax, 0xffffffff
je 0x415394
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41538d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41538d
cmp edx, 0x10000000
jae 0x41538d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41538a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x415400
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41543e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x415436
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x415440
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x415426
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x415510
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x415541
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x415541
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x415541
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x415db0
Capabilities:
Migrate process to active window station

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4285f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
je 0x415dee
xor eax, eax
inc eax
jmp 0x415e55
push ebx
push esi
mov ebx, 0x2000000
push ebx
push edi
push 0x402fa0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
test eax, eax
je 0x415e51
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push ebx
push edi
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
test esi, esi
jne 0x415e31
push ebx
push edi
push eax
push 0x402fb0
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
je 0x415e51
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
xor eax, eax
inc eax
jmp 0x415e53
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004151b0
leave
ret 4

Function at 0x4160f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41611b
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x416160
mov ecx, dword [ebp - 4]
jmp 0x416121
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x41614e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x416160
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x1c]
jne 0x416160
xor eax, eax
inc eax
jmp 0x416162
xor eax, eax
pop esi
leave
ret 0x18
Function at 0x416167
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41618c
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4161bc
mov eax, dword [ebp - 4]
jmp 0x416192
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4161b7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x4161c0
xor eax, eax
jmp 0x4161c3
xor eax, eax
inc eax
pop esi
leave
ret 0x18