joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403018
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, eax
mov eax, esi
call fcn.00402ffc
test al, al
jne 0x403075
mov eax, esi
call fcn.004021dc
mov edi, eax
push esp
push 0x105
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x403075
cmp byte [esp + ebx - 1], 0x5c
je 0x403054
mov byte [esp + ebx], 0x5c
inc ebx
lea eax, [edi + ebx]
cmp eax, 0x105
jge 0x403075
lea edx, [esi + ebx]
mov eax, esi
mov ecx, edi
call fcn.0040118c
mov edx, esi
mov eax, esp
mov ecx, ebx
call fcn.0040118c
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
test esi, esi
je 0x403220
lea eax, [ebp - 0x152]
mov edx, 0x106
call fcn.00401f08
mov edi, esi
cmp byte [edi], 0x22
sete dl
test dl, dl
je 0x4030e6
inc edi
mov ebx, edi
jmp 0x4030eb
inc ebx
xor ecx, ecx
mov cl, dl
mov cl, byte [ecx + 0x4071b8]
mov al, byte [ebx]
cmp cl, al
je 0x4030ff
test al, al
jne 0x4030ea
mov ecx, ebx
sub ecx, edi
lea edx, [ebp - 0x152]
mov eax, edi
call fcn.0040118c
cmp byte [ebx], 0x22
jne 0x403119
inc ebx
jmp 0x403119
inc ebx
cmp byte [ebx], 0x20
je 0x403118
cmp byte [ebx], 0
jne 0x403125
xor ebx, ebx
lea edx, [ebp - 0x152]
mov al, 0x5c
call fcn.00403080
test eax, eax
jl 0x403147
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x152]
call fcn.00403018
jmp 0x40314b
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x4c]
mov edx, 0x3c
call fcn.00401f08
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x640
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x4071c4]
mov dword [ebp - 0x30], eax
xor eax, eax
mov al, byte [ebp - 5]
mov eax, dword [eax*4 + 0x4071bc]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x152]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
cmp byte [ebp - 0xd], 0
je 0x4031f8
cmp dword [ebp - 0x34], 0
jne 0x4031f8
lea eax, [ebp - 0x152]
call fcn.00402ffc
test al, al
je 0x4031f8
lea eax, [ebp - 0x152]
call fcn.004021dc
mov ebx, eax
inc ebx
lea edx, [ebp - 0x258]
lea eax, [ebp - 0x152]
mov ecx, ebx
call fcn.0040118c
jmp 0x4031d5
dec ebx
test ebx, ebx
jle 0x4031e3
cmp byte [ebp + ebx - 0x258], 0x5c
jne 0x4031d4
test ebx, ebx
jle 0x4031f8
mov byte [ebp + ebx - 0x258], 0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x403213
cmp dword [ebp - 0x2c], 0x20
jbe 0x403213
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x403220
cmp byte [ebp - 5], 0
jne 0x403220
mov eax, esi
call fcn.00402b30
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40322c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4032dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
call sub.KERNEL32.DLL_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004015a0
lea eax, [ebp - 8]
mov edx, 0x4032f4
call fcn.004015f0
test ebx, ebx
je 0x403285
push dword [ebp - 8]
push 0x403304
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.004016a8
push 0
mov cl, 1
mov edx, dword [0x40807c]
mov eax, dword [ebp - 8]
call fcn.004030a8
mov ebx, eax
test ebx, ebx
je 0x4032c6
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
jne 0x4032be
lea eax, [ebp - 4]
push eax
push ebx
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x4032be
mov dword [ebp - 4], 0xffffffff
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032e3
lea eax, [ebp - 8]
call fcn.0040148c
ret

Function at 0x40339c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
mov esi, esp
cmp dword [0x4384e4], 0xff
jbe 0x403422
cmp dword [0x4384f4], 0
je 0x403422
cmp dword [0x4384e4], 0x1000000
jb 0x4033e2
mov eax, dword [0x4384e0]
shr eax, 8
imul eax, eax, 0x64
mov edx, dword [0x4384e4]
shr edx, 8
mov ecx, edx
xor edx, edx
div ecx
jmp 0x4033f1
imul eax, dword [0x4384e0], 0x64
xor edx, edx
div dword [0x4384e4]
push 0
push eax
push 0x402
mov eax, dword [0x4384f4]
push eax
call sub.user32.dll_SendMessageA
jmp 0x403422
push esi
call sub.user32.dll_GetActiveWindow
push eax
call sub.user32.dll_IsDialogMessageA
test eax, eax
jne 0x403422
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x403406
test bl, bl
je 0x40344e
push 0
push 8
push 0x111
mov eax, dword [0x4384f0]
push eax
call sub.user32.dll_PostMessageA
jmp 0x403487
cmp byte [0x438502], 0
jne 0x403487
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [0x4384fc]
add edx, 0x28
sub edx, eax
mov eax, edx
cmp eax, 0x28
jle 0x403473
mov eax, 0x28
test eax, eax
jl 0x40347d
push eax
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x4384fc], eax
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x403490
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x4380c0
mov eax, ebx
mov edx, 8
test al, 1
jne 0x4034a7
shr eax, 1
jmp 0x4034ae
shr eax, 1
xor eax, 0xedb88320
dec edx
jne 0x40349f
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x403498
pop ebx
ret
Function at 0x4034d8
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, eax
mov ebp, 0x4384c0
mov esi, edi
dec esi
test esi, esi
jb 0x40350c
inc esi
mov dword [esp], 0
mov ebx, 0x4180c0
mov edx, dword [ebp]
mov al, byte [ebx]
call fcn.004034c4
mov dword [ebp], eax
inc dword [esp]
inc ebx
dec esi
jne 0x4034f8
add dword [0x4384c4], edi
cmp dword [0x408094], 0
je 0x40354a
push 0
call sub.KERNEL32.DLL_SetLastError
push 0
lea eax, [esp + 4]
push eax
push edi
push 0x4180c0
mov eax, dword [0x408094]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x403543
cmp edi, dword [esp]
jbe 0x40354a
xor eax, eax
call fcn.00402b30
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403f5c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4040b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x4384e0], eax
xor eax, eax
mov dword [0x4384e8], eax
mov eax, dword [esi + 0x10]
mov dword [0x4384e4], eax
cmp dword [0x4384e4], 0
jne 0x403f9f
inc dword [0x4384e4]
mov eax, dword [esi + 0x10]
mov ecx, 0x64
xor edx, edx
div ecx
mov dword [0x4384ec], eax
xor eax, eax
push ebp
push 0x404097
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 8]
dec eax
test eax, eax
jl 0x404082
inc eax
mov dword [ebp - 4], eax
xor edi, edi
cmp byte [0x438501], 0
jne 0x404082
mov eax, 0x408088
imul ebx, edi, 0xd
mov edx, dword [esi]
mov edx, dword [edx + ebx*4 + 0x30]
call fcn.004014e0
mov eax, dword [esi]
lea eax, [eax + ebx*4]
mov ebx, eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00402c5c
mov edx, dword [ebp - 8]
mov eax, dword [0x408088]
call fcn.004016f8
je 0x404015
call fcn.00402b3c
mov edx, ebx
mov eax, 0x408088
call fcn.00402d04
mov eax, 0x408088
call fcn.00402d2c
test al, al
je 0x40404b
cmp dword [0x4080ae], 0
je 0x40403d
call fcn.00402b3c
xor edx, edx
mov eax, dword [0x408088]
call fcn.00402e74
jmp 0x404078
mov eax, dword [0x408088]
call fcn.00402f64
call fcn.00403c44
mov eax, dword [0x4080a2]
call fcn.0040333c
call fcn.00402f48
mov eax, dword [ebx + 0x26]
push eax
mov eax, dword [0x408088]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
inc edi
dec dword [ebp - 4]
jne 0x403fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40409e
mov al, 1
call fcn.0040339c
ret
Function at 0x4040c4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4040cd
mov eax, dword [esp + 0x10000]
add esp, 0xffffffe8
mov dword [esp], edx
mov esi, eax
mov eax, dword [esp]
call fcn.0040148c
push 0
mov eax, dword [0x408090]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
mov edx, 2
mov eax, 0xffffffea
call fcn.00402b5c
mov eax, esi
mov edx, 0x16
call fcn.00402bb8
mov eax, dword [esi]
cmp eax, dword [0x4071a4]
jne 0x404129
cmp word [esi + 0x14], 0
je 0x404196
cmp ebx, 0x10016
jbe 0x404136
mov ebx, 0x10016
mov eax, ebx
neg eax
mov edx, 2
call fcn.00402b5c
lea eax, [esp + 4]
mov edx, ebx
call fcn.00402bb8
mov ecx, ebx
sub ecx, 0x16
dec ecx
cmp ecx, 0
jb 0x404191
lea eax, [esp + ecx + 4]
mov edx, eax
mov ebx, dword [edx]
cmp ebx, dword [0x4071a4]
jne 0x40418a
push esi
mov edi, esi
mov esi, edx
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
add edx, 0x16
movzx ecx, word [esi + 0x14]
mov eax, dword [esp]
call fcn.00401570
jmp 0x404196
dec ecx
dec eax
cmp ecx, 0xffffffff
jne 0x40415e
call fcn.00402b4c
add esp, 0x1001c
pop edi
pop esi
pop ebx
ret

Function at 0x4041a0
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov esi, ecx
mov ebp, edx
mov edi, eax
mov ebx, esi
push esp
push ebp
mov eax, dword [0x4384f0]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jl 0x4041f4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDList
test eax, eax
je 0x4041eb
push edi
mov edi, esi
lea esi, [esp + 8]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
lea ebx, [esp + 4]
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
push ebx
push edi
call sub.KERNEL32.DLL_SetEnvironmentVariableA
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404208
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
push 0x106
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x404235
lea eax, [esp + ebx]
cmp byte [eax], 0x5c
je 0x404235
dec ebx
dec eax
cmp ebx, 0xffffffff
jne 0x404229
test ebx, ebx
jl 0x404253
mov eax, 0x40428c
call fcn.004017ac
lea edx, [esp + ebx + 1]
mov ecx, 0xe
call fcn.0040118c
jmp 0x404257
mov byte [esp], 0
mov ecx, esp
mov eax, 0x40429c
mov edx, 0x26
call fcn.004041a0
mov ecx, esp
mov eax, 0x4042ac
mov edx, 0x2b
call fcn.004041a0
add esp, 0x108
pop ebx
ret
Function at 0x4042c4
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef8
mov ebp, eax
push esp
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
mov esi, eax
dec esi
cmp byte [esp + esi], 0x5c
je 0x4042e5
inc esi
mov ebx, 5
mov eax, 0x404364
call fcn.004017ac
lea edx, [esp + esi]
mov ecx, ebx
call fcn.0040118c
add esi, ebx
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
and edi, 0xff0
xor ebx, ebx
cmp ebx, 0xf
jle 0x40431b
mov eax, esp
call fcn.00402b30
lea eax, [ebx + edi]
push eax
push 0x40436c
lea eax, [esp + esi + 8]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
inc ebx
push 0
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x40430f
mov eax, ebp
mov edx, esp
mov ecx, 0x106
call fcn.004015d0
add esp, 0x108
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404468
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x404562
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x40453f
cmp byte [0x43851c], 0
je 0x40453f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 2
push 0
push 0
push 0
push 0x404574
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x40453f
lea eax, [ebp - 0x14]
mov edx, dword [0x4073ac]
movzx edx, byte [edx]
mov edx, dword [edx*4 + 0x4072e4]
call fcn.004015a0
push dword [ebp - 0x14]
push 0x4045b0
push esi
push 0x4045bc
lea eax, [ebp - 8]
mov edx, 4
call fcn.004016a8
lea edx, [ebp - 4]
mov eax, esi
call fcn.00402dc0
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4045c8
call fcn.00401634
mov eax, dword [ebp - 8]
call fcn.004015e8
inc eax
push eax
lea eax, [ebp - 8]
call fcn.004017b8
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404569
lea eax, [ebp - 0x14]
call fcn.0040148c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004014b0
ret

Function at 0x4045d0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
add esp, 0xfffffedc
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40463c
cmp byte [0x43851c], 0
je 0x40463c
mov eax, esp
mov edx, 0x124
call fcn.00401f08
mov eax, esi
call fcn.004015e8
push eax
mov eax, esi
call fcn.004017ac
lea edx, [esp + 0x22]
pop ecx
call fcn.0040118c
mov dword [esp + 4], 3
lea eax, [esp + 0x1e]
mov dword [esp + 8], eax
mov word [esp + 0x10], 0x14
push esp
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x404636
cmp dword [esp + 0x12], 0
je 0x40463a
xor ebx, ebx
jmp 0x40463c
mov bl, 1
mov eax, ebx
add esp, 0x124
pop esi
pop ebx
ret
Function at 0x4052b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov esi, edx
mov ebx, eax
mov byte [ebp - 0x10e], 0
mov dword [ebp - 8], 0x105
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10e]
push eax
lea eax, [ebp - 4]
push eax
push 0
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40530c
cmp dword [ebp - 4], 1
jne 0x40530c
cmp dword [ebp - 8], 0
je 0x40530c
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x10e], 0
jmp 0x405313
mov byte [ebp - 0x10e], 0
mov eax, esi
lea edx, [ebp - 0x10e]
mov ecx, 0x106
call fcn.004015d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40532c
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x438588
mov byte [ebp - 5], 0
cmp dword [edi], 0
je 0x4054ce
xor ebx, ebx
mov eax, dword [edi]
cmp byte [eax], 0x24
jne 0x405363
mov bl, 1
mov eax, edi
mov ecx, 1
mov edx, 1
call fcn.004017ec
mov eax, 0x4054d8
mov edx, dword [edi]
call fcn.00402214
test al, al
je 0x405386
mov eax, edi
mov ecx, 0x12
mov edx, 1
call fcn.004017ec
jmp 0x4053d4
mov eax, 0x4054ec
mov edx, dword [edi]
call fcn.00402214
test al, al
je 0x4053a9
mov eax, edi
mov ecx, 5
mov edx, 1
call fcn.004017ec
jmp 0x4053d4
cmp byte [0x43851c], 0
je 0x4053bf
cmp byte [0x40738c], 1
je 0x4054ce
mov eax, 0x43859c
mov edx, dword [edi]
call fcn.004014e0
mov byte [ebp - 5], 1
jmp 0x4054ce
xor edx, edx
mov eax, dword [edi]
call fcn.0040527c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405459
push ebp
mov edx, 0x43859c
mov eax, 0x4054f4
call fcn.004052b4
pop ecx
cmp dword [0x43859c], 0
je 0x4054ce
push ebp
mov edx, 0x4385a0
mov eax, 0x4054f8
call fcn.004052b4
pop ecx
mov eax, dword [0x4385a0]
call fcn.004029ec
mov byte [0x4385a4], al
push ebp
mov edx, 0x4385a0
mov eax, 0x4054fc
call fcn.004052b4
pop ecx
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
je 0x4054ce
mov eax, dword [edi]
push eax
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
jmp 0x4054ce
mov edx, dword [edi]
mov al, 0x5c
call fcn.0040258c
mov esi, eax
test esi, esi
je 0x4054ce
mov eax, dword [edi]
call fcn.004015e8
cmp esi, eax
je 0x4054ce
mov eax, edi
call fcn.004017b8
mov byte [eax + esi - 1], 0
mov eax, edi
call fcn.004017b8
add eax, esi
mov esi, eax
mov edx, ebx
mov eax, dword [edi]
call fcn.0040527c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4054ce
push ebp
mov edx, 0x43859c
mov eax, esi
call fcn.004052b4
pop ecx
cmp dword [0x43859c], 0
je 0x4054ce
mov byte [ebp - 5], 1
test bl, bl
je 0x4054c5
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x405540
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
push ecx
cmp dword [0x438584], 0
je 0x405651
push 0
test byte [0x4072e0], 4
setne cl
mov edx, dword [0x438554]
mov eax, dword [0x438584]
call fcn.004030a8
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x4055fd
cmp dword [0x438588], 0
jne 0x4055ab
cmp dword [0x43859c], 0
jne 0x4055ab
cmp byte [0x40738c], 1
je 0x4055ab
mov ecx, 0x438594
mov edx, 0x405658
mov eax, dword [0x408080]
call fcn.0040289c
test al, al
je 0x4055f5
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
sete al
neg al
sbb ebx, ebx
test ebx, ebx
je 0x4055d7
push esp
push esi
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x4055d7
mov eax, dword [0x4073a0]
mov edx, dword [esp]
mov dword [eax], edx
jmp 0x4055e2
mov eax, dword [0x4073a0]
mov dword [eax], 0xffffffff
test ebx, ebx
je 0x4055f5
mov eax, dword [0x4073a0]
cmp dword [eax], 0
jne 0x4055f5
call fcn.00405500
push esi
call sub.KERNEL32.DLL_CloseHandle
mov esi, eax
cmp byte [0x40738c], 1
jne 0x405611
test ebx, ebx
jne 0x405611
mov byte [0x40738c], 2
cmp byte [0x40738c], 1
jne 0x40563e
mov eax, dword [0x40807c]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, dword [0x438554]
call fcn.004045d0
neg al
sbb ebx, ebx
test ebx, ebx
jne 0x40563e
mov byte [0x40738c], 2
cmp byte [0x40738c], 2
jne 0x405651
mov eax, dword [0x438554]
call fcn.00404468
pop edx
pop esi
pop ebx
ret
Function at 0x401090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x410928]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x124]
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40111c
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40111c
lea eax, [esp + 0x14]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401112
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.00401fbc
add esp, 0x110
ret

Function at 0x401140
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc8
mov eax, dword [0x410928]
xor eax, esp
mov dword [esp + 0xc4], eax
push ebx
mov ebx, dword [esp + 0xd0]
push ebp
mov ebp, dword [esp + 0xd8]
xor eax, eax
push esi
mov esi, dword [esp + 0xe0]
push edi
mov edi, dword [esp + 0xe8]
push 0x9c
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x40]
push eax
call fcn.00401fd0
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 2
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
jne 0x4011e0
cmp ecx, 5
jne 0x4011e0
test eax, eax
jne 0x4011e0
mov dword [esi], 1
jmp 0x4011f6
cmp byte [esp + 0xd2], 1
jne 0x4011f6
cmp ecx, 6
jne 0x4011f6
cmp eax, 1
jne 0x4011f6
mov dword [edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x40121e
lea edx, [esp + 0x10]
push edx
call eax
jmp 0x401229
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call edi
test eax, eax
je 0x401251
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x40]
push 0
push 0
push edx
push ecx
call eax
mov eax, dword [esp + 0x10]
cmp ax, 9
je 0x401269
cmp ax, 6
je 0x401269
mov dword [ebx], 1
jmp 0x401270
mov dword [ebp], 1
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401fbc
add esp, 0xc8
ret

Function at 0x401fbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410928]
jne 0x401fc6
repz ret
jmp fcn.00404b4c
Function at 0x407c6b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402d25
and dword [ebp - 4], 0
cmp dword [0x4121c8], 0
mov ebx, eax
jne 0x407d1c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407dcd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407dcd
push eax
call fcn.00402cb3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4121c8], eax
call esi
push eax
call fcn.00402cb3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4121cc], eax
call esi
push eax
call fcn.00402cb3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4121d0], eax
call esi
push eax
call fcn.00402cb3
pop ecx
mov dword [0x4121d8], eax
test eax, eax
je 0x407d1c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402cb3
pop ecx
mov dword [0x4121d4], eax
mov eax, dword [0x4121d4]
cmp eax, ebx
je 0x407d74
cmp dword [0x4121d8], ebx
je 0x407d74
push eax
call fcn.00402d2e
push dword [0x4121d8]
mov esi, eax
call fcn.00402d2e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407d74
test edi, edi
je 0x407d74
call esi
test eax, eax
je 0x407d6b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407d6b
test byte [ebp - 0xc], 1
jne 0x407d74
or dword [ebp + 0x10], 0x200000
jmp 0x407dad
mov eax, dword [0x4121cc]
cmp eax, ebx
je 0x407dad
push eax
call fcn.00402d2e
pop ecx
test eax, eax
je 0x407dad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407dad
mov eax, dword [0x4121d0]
cmp eax, ebx
je 0x407dad
push eax
call fcn.00402d2e
pop ecx
test eax, eax
je 0x407dad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4121c8]
call fcn.00402d2e
pop ecx
test eax, eax
je 0x407dcd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407dcf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret