joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b60
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x6c]
test esi, esi
je 0x403c44
test edi, edi
je 0x403c44
mov eax, dword [esp + 0x68]
lea ebp, [esp + 0x2c]
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 0x10], ebp
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x403c30
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x403cb0
mov eax, dword [esp + 0x60]
mov edx, ebp
mov dword [esp + 0x30], edi
call fcn.00402ac0
test eax, eax
jne 0x403c50
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x7e1
mov dword [esp], eax
call fcn.004026d0
add esp, 0x4c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
jne 0x403ce0
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], edi
mov edi, dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x403cd0
mov ebx, 1
jmp 0x403c04
mov eax, dword [esp + 0x60]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call fcn.004026d0
jmp 0x403c04
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
sub esp, 8
mov eax, dword [esp + 0x60]
mov dword [esp + 4], 0x7e1
mov dword [esp], eax
call fcn.004026d0
jmp 0x403c04
Function at 0x404770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
mov ebx, eax
sub esp, 0x6c
lea eax, [esp + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x4047c0
add esp, 0x6c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x54]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test eax, eax
jne 0x404960
mov edx, dword [esp + 0x50]
test edx, edx
jne 0x404858
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
sub esp, 4
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x54]
add eax, 1
mov dword [esp + 0x54], eax
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test ebx, ebx
je 0x4048a4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], ebx
call dword [0x4155ec]
sub esp, 0x10
mov eax, dword [esp + 0x50]
test eax, eax
je 0x404948
lea ebp, [esp + 0x5c]
xor edi, edi
jmp 0x4048bd
add edi, 1
cmp edi, dword [esp + 0x50]
jae 0x404948
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x58]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
jne 0x4048b0
cmp dword [esp + 0x5c], 1
jne 0x4048b0
test ebx, ebx
je 0x4049a0
lea eax, [edi + 0x80e8]
mov dword [esp + 0xc], esi
add edi, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [0x4155ec]
sub esp, 0x10
cmp edi, dword [esp + 0x50]
jb 0x4048bd
lea esi, [esi]
nop
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40483a
test byte [0x410014], 2
je 0x40483a
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegQueryInfoKey_failed:__ld_n
mov dword [esp + 8], str.add_favourite_key_items
mov dword [esp + 4], 0x410014
mov dword [esp], 1
call fcn.00404720
jmp 0x40483a
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4048b0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x180
mov dword [esp], eax
call dword [0x4156fc]
sub esp, 0x10
jmp 0x4048b0
Function at 0x407e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [esp + 0x118]
mov ebp, dword [esp + 0x110]
mov ecx, dword [esp + 0x114]
mov ebx, dword [esp + 0x11c]
mov edi, dword [esp + 0x120]
cmp eax, 7
je 0x408060
ja 0x407ee0
cmp eax, 2
ja 0x408018
test eax, eax
je 0x407f58
test ebx, ebx
mov eax, 0x414ba0
mov dword [esp + 0x78], 2
cmove ebx, eax
mov dword [esp + 0x84], ebx
lea eax, [esp + 0x70]
mov dword [esp + 0xc], eax
jmp 0x407f32
cmp eax, 0xb
jne 0x407f58
mov esi, dword [ebx]
mov dword [esp + 0x24], ecx
mov edi, dword [ebx + 4]
lea ebx, [esp + 0x70]
mov dword [esp + 8], str.0x_08I64x___I64u_
mov dword [esp + 4], 0x40
mov dword [esp], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.00407d40
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], 2
mov dword [esp + 0x48], ebx
mov dword [esp + 0xc], eax
mov dword [esp], ebp
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x1074
call dword [0x4156fc]
sub esp, 0x10
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edi + edi*2]
mov dword [esp + 0x28], ecx
add eax, eax
mov dword [esp + 0x24], eax
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test edi, edi
mov ecx, dword [esp + 0x28]
mov edx, eax
je 0x407fba
mov esi, eax
add edi, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
lea esi, [esi]
nop
movzx eax, byte [ebx]
add ebx, 1
mov dword [esp], esi
add esi, 6
mov dword [esp + 4], str._02X
mov dword [esp + 8], eax
call dword [0x415748]
cmp ebx, edi
jne 0x407f90
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x84], edx
mov dword [esp + 0x78], 2
mov word [edx + eax], bx
lea eax, [esp + 0x70]
mov dword [esp], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x1074
call dword [0x4156fc]
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov dword [esp + 0x110], edx
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll_free]
lea esi, [eax - 4]
cmp esi, 1
ja 0x407f58
mov ebx, dword [ebx]
cmp eax, 5
mov dword [esp + 0x24], ecx
mov dword [esp + 4], str.0x_08x___u_
mov esi, ebx
bswap esi
cmove ebx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
lea ebx, [esp + 0x70]
mov dword [esp], ebx
call dword [0x415748]
jmp 0x407f1a
cmp word [ebx], 0
mov eax, ebx
je 0x408079
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408070
cmp word [eax + 2], 0
je 0x4080a0
mov esi, 0x2c
add eax, 2
mov word [eax - 2], si
add eax, 2
cmp word [eax], 0
jne 0x408070
jmp 0x408079
mov dword [esp + 0x78], 2
jmp 0x407ecb
Function at 0x4097a0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x500
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
mov ebx, eax
test eax, eax
jne 0x409850
mov edi, dword fs:[0x18]
cmp dword [edi + 0x34], 0xeb
je 0x409850
test byte [0x410188], 1
je 0x40989e
mov eax, esi
call fcn.004094d0
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x34]
mov dword [esp + 0xc], str.Could_not_format_string:_le_lu__fmt_s_n
mov dword [esp + 8], 0x411b88
mov dword [esp + 4], 0x410188
mov dword [esp + 0x10], eax
mov dword [esp], 0
call fcn.00409750
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x48]
mov dword [esp], 0xfffffff5
mov ebp, dword [sym.imp.kernel32.dll_GetStdHandle]
call ebp
sub esp, 4
lea edi, [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4098b0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [esp + 0x38], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp + 0x34], eax
call eax
sub esp, 0x20
mov dword [esp + 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [esp + 0x38]
test eax, eax
mov dword [esp + 0x30], eax
je 0x40988e
call edx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp + 0x10], ecx
call eax
sub esp, 0x20
mov dword [esp], 0xfffffff5
call ebp
sub esp, 4
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40988e
Function at 0x409a70
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0xc18]
push ebx
mov ebx, ecx
push ecx
sub esp, 0xc28
mov edi, dword [ecx]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x600
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [0x4156c0]
sub esp, 0x10
test eax, eax
jne 0x409ae0
test byte [0x410188], 1
jne 0x409b00
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea edx, [ebx + 4]
mov eax, esi
call fcn.004097a0
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
nop
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed_with__lu_n
mov dword [esp + 8], str.error_exit
mov dword [esp + 4], 0x410188
mov dword [esp], 0
mov dword [esp + 0x10], eax
call fcn.00409750
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x40a9e0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov dword [esp + 4], 0x411c28
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40aac0
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__fileno]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__setmode]
mov dword [esp + 0xc], ebx
test edi, edi
je 0x40aa98
mov esi, dword [sym.imp.ucrtbase.dll_fwrite]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x411d2e
call esi
mov eax, str.Windows_Registry_Editor_Version_5.00_r_n
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x40aa60
sub eax, str.Windows_Registry_Editor_Version_5.00_r_n
mov dword [esp + 0xc], ebx
sar eax, 1
mov dword [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp], str.Windows_Registry_Editor_Version_5.00_r_n
call esi
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str.REGEDIT4_r_n
call sub.ucrtbase.dll_fwrite
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x411c2c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__wfopen]
mov ebx, eax
test eax, eax
jne 0x40aa2f
mov dword [esp], 0x411c32
call dword [sym.imp.ucrtbase.dll__wperror]
mov dword [esp + 4], esi
mov dword [esp], 0xbbf
call fcn.00409a70
jmp 0x40aa2f

Function at 0x40b030
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x14
test ecx, ecx
je 0x40b078
cmp word [edx], 0
je 0x40b0a8
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40b048
sub eax, esi
sar eax, 1
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 2
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x14
pop ebx
pop esi
ret
test edx, edx
je 0x40b085
mov eax, edx
call fcn.0040af90
mov esi, eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fputs]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x14
pop ebx
pop esi
ret
xor eax, eax
jmp 0x40b055
Function at 0x40c0a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x40c0d5
lea eax, [esp + 0x16]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fread]
cmp eax, 1
je 0x40c0e0
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [esp + 0x16]
xor esi, esi
mov ecx, 0x40adb0
movzx ebp, byte [esp + 0x17]
cmp dl, 0xff
jne 0x40c10a
mov eax, ebp
mov edi, 0x40a810
cmp al, 0xfe
cmove ecx, edi
sete al
movzx eax, al
mov esi, eax
mov eax, ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
lea ebx, [esp + 0x18]
movzx eax, al
shl eax, 0x10
mov dword [0x414ddc], ecx
or eax, edx
mov edx, 0xffffffff
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov word [esp + 0x24], dx
mov edx, 0x40a710
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
jmp 0x40c19b
mov edx, dword [esp + 0x48]
mov edx, dword [edx*4 + 0x411de0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
test eax, eax
jne 0x40c190
movzx eax, word [esp + 0x24]
lea edx, [eax - 3]
cmp dx, 1
jbe 0x40c200
mov eax, dword [esp + 0x30]
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call ebx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40c1ee
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, 1
jmp 0x40c0d7
cmp ax, 3
sete al
add esp, 0x5c
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret

Function at 0x40c220
Capabilities:
Delete registry key

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x1c], 0
test ebx, ebx
je 0x40c23c
cmp word [ebx], 0
jne 0x40c248
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.0040a5b0
mov edi, dword [esp + 0x1c]
mov esi, eax
test eax, eax
je 0x40c290
test edi, edi
je 0x40c2c0
cmp word [edi], 0
jne 0x40c277
mov dword [esp + 4], ebx
mov dword [esp], 0xbce
call fcn.00409a70
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
add esp, 0x20
pop ebx
pop esi
pop edi
ret
test edi, edi
je 0x40c2b0
xor eax, eax
mov word [edi - 2], ax
mov dword [esp + 4], ebx
mov dword [esp], 0xbcc
call fcn.00409a70
jmp 0x40c261
mov dword [esp + 4], ebx
mov dword [esp], 0xbcc
call fcn.00409a70
xor edi, edi
jmp 0x40c267
Function at 0x40e530
Capabilities:
Query or enumerate registry key

Disassembly:
mov edx, dword [0x414dec]
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
test edx, edx
jne 0x40e558
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x3c]
mov eax, ebx
pop ebx
jmp fcn.0040cdc0
xor eax, eax
pop ebx
ret

Function at 0x40f3a0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x40f410
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40f477
xor ecx, ecx
xor edx, edx
jmp 0x40f459
cmp ax, 0x5c
jne 0x40f4e8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40f477
cmp ax, 9
je 0x40f465
cmp ax, 0x20
jne 0x40f440
test ecx, ecx
je 0x40f4d3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40f459
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40f508
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00408ef0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40f4d0
cmp ax, 0x20
je 0x40f4d0
jmp 0x40f477
cmp ax, 0x22
jne 0x40f469
and edx, 1
jne 0x40f469
xor ecx, 1
jmp 0x40f44d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40f490
Function at 0x40f410
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x40f410
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40f477
xor ecx, ecx
xor edx, edx
jmp 0x40f459
cmp ax, 0x5c
jne 0x40f4e8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40f477
cmp ax, 9
je 0x40f465
cmp ax, 0x20
jne 0x40f440
test ecx, ecx
je 0x40f4d3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40f459
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40f508
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00408ef0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40f4d0
cmp ax, 0x20
je 0x40f4d0
jmp 0x40f477
cmp ax, 0x22
jne 0x40f469
and edx, 1
jne 0x40f469
xor ecx, 1
jmp 0x40f44d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40f490

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219