joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4018a6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40193a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4018f5
cmp eax, 0x40
je 0x4018f5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401899
cmp eax, 0x40
je 0x401899
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401899
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x401fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x415728]
sub esp, 0x10
cmp dword [0x4156ec], ecx
jg 0x402002
jne 0x402086
mov ecx, dword [0x415738]
cmp dword [0x415704], ecx
jg 0x402002
jne 0x402086
mov eax, dword [0x415710]
cmp eax, dword [0x4156b0]
jl 0x402086
push 0x40b870
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Error
call fcn.0040b5a0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [esp + 4]
mov dword [esp + 4], 0x1388
push eax
lea ecx, [esp + 0xc]
call fcn.0040bb30
mov ecx, eax
call fcn.0040bb50
push 0x40b870
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Exit
call fcn.0040b5a0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [esp + 4]
mov dword [esp + 4], 0x3e8
push eax
lea ecx, [esp + 0xc]
call fcn.0040bb30
mov ecx, eax
call fcn.0040bb50
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x40a2f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40a31c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x40a344
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40a34a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x40a3b2
jg 0x40a361
test esi, esi
je 0x40a3b2
test ecx, ecx
jl 0x40a3ad
jg 0x40a36b
test eax, eax
je 0x40a3ad
cmp edi, ecx
jg 0x40a37f
jl 0x40a375
cmp esi, eax
jae 0x40a37f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x40a3b5
mov ecx, dword [ebp + 8]
jmp 0x40a3bf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x40a3d9
jg 0x40a3bf
test esi, esi
je 0x40a3d9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40a3d9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a3f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40a41c
jl 0x40a410
test ecx, ecx
jne 0x40a41c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40a435
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40a483
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x40a489
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x40a489
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x40a4f6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40a4b2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x40a4e4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40a4f6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x40a4c0
test edi, edi
je 0x40a4f6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x41500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40a8a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40a8dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40a8dc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40a9b3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40a904
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40a910
movsx eax, bl
jmp 0x40a948
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x40a972
sub eax, 1
je 0x40a972
sub eax, 2
jne 0x40a9b3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a990
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a9b3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040df80
mov esp, ebp
pop ebp
ret 4
Function at 0x40b140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40b1fc
cmp byte [esi + 0x3d], 0
je 0x40b1fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40b1ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40b1b1
sub eax, 1
je 0x40b1b5
sub eax, 2
jne 0x40b1ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40b1d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40b1ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040df80
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040df80
mov esp, ebp
pop ebp
ret

Function at 0x40e9e6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ea25
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ea25
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ea25
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40ea25
cmp dword [ecx + 0x74], 0xe
jbe 0x40ea25
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403512
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4ae4f0
call fcn.0049dfc4
sub esp, 0x34
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], ebx
push 0x20019
push str.SOFTWAREFLEXnetConnectTrace_
push dword [esi + 0x1c]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00403674
test eax, eax
jne 0x403658
push edi
push 0x4f1ed4
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], vtable._zstring_class_ztraits_0__.0
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
push ebx
push str.Class
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 4
call edi
cmp eax, ebx
je 0x403595
mov dword [esi], ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x30]
push eax
call fcn.0041120a
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00411336
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.Param
push dword [ebp - 0x14]
call edi
cmp eax, ebx
lea ecx, [ebp - 0x40]
setne byte [ebp - 0xd]
mov byte [ebp - 4], 1
call fcn.00401d79
cmp byte [ebp - 0xd], bl
je 0x40361c
lea eax, [ebp - 0x40]
push 0x1a
push eax
call fcn.004037db
mov eax, dword [eax + 0xc]
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
push dword [esi + 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea ecx, [ebp - 0x40]
mov dword [esi + 0x18], eax
call fcn.004036b2
push str.ISUSTrace.txt
lea ecx, [esi + 0xc]
call fcn.004036f4
jmp 0x403628
lea eax, [ebp - 0x30]
lea ecx, [esi + 0xc]
push eax
call fcn.00410f26
lea eax, [ebp - 0x20]
add esi, 8
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
push ebx
push str.Options
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 4
call edi
test eax, eax
pop edi
je 0x403650
mov dword [esi], ebx
lea ecx, [ebp - 0x30]
call fcn.004012b4
cmp dword [ebp - 0x14], ebx
pop esi
pop ebx
je 0x403668
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4037db
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4ae52a
call fcn.0049dfc4
sub esp, 0x12c
push ebx
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x137]
mov byte [ebp - 0x138], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x403851
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x403851
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x403851
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp byte [ebp - 0x138], bl
lea eax, [ebp - 0x138]
push eax
je 0x403888
lea ecx, [ebp - 0x34]
call fcn.004038ec
mov dword [ebp - 0x34], vtable.zpath.0
mov dword [ebp - 0x10], 1
push 0x4e53c8
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.00403949
jmp 0x4038a8
lea ecx, [ebp - 0x24]
call fcn.004038ec
mov dword [ebp - 0x24], vtable.zpath.0
mov dword [ebp - 0x10], 2
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.00403913
mov ebx, dword [ebp - 0x10]
mov dword [edi], vtable.zpath.0
or ebx, 4
test bl, 2
je 0x4038cf
lea ecx, [ebp - 0x24]
and ebx, 0xfffffffd
call fcn.004036b2
test bl, 1
je 0x4038dc
lea ecx, [ebp - 0x34]
call fcn.004036b2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404ab2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x404b21
push 1
push 0
push 0
push str.http:__www.acresso.com
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [esi + 0x4c], 0xa00000
mov byte [esi + 0x50], 1
jmp 0x404b27
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x408ca3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4af31e
call fcn.0049dfc4
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 4], eax
lea ebx, [esi + 4]
mov edi, vtable._zstring_class_ztraits_0__.0
mov dword [ebx + 0xc], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x44]
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0xc], eax
mov byte [ebp - 4], 9
call fcn.00401e1e
mov eax, dword [ebp - 0x10]
mov dword [eax], edi
mov al, byte [ebp + 8]
mov ecx, ebx
mov byte [esi], al
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 0xa
call fcn.00410f26
lea eax, [ebp + 0x20]
lea ecx, [esi + 0x14]
push eax
call fcn.00410f26
lea eax, [ebp + 0x30]
lea ecx, [esi + 0x24]
push eax
call fcn.00410f26
mov al, byte [ebp + 0xc]
lea ecx, [esi + 0x34]
mov byte [esi + 0x54], al
mov al, byte [ebp + 0x40]
mov byte [esi + 0x55], al
lea eax, [ebp + 0x54]
push eax
call fcn.00410f26
lea eax, [ebp + 0x44]
lea ecx, [esi + 0x44]
push eax
call fcn.00410f26
mov eax, dword [ebp + 0x64]
lea ecx, [ebp + 0x10]
mov dword [esi + 0x58], eax
mov byte [ebp - 4], 3
call fcn.004012b4
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 2
call fcn.004012b4
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 1
call fcn.004012b4
and byte [ebp - 4], 0
lea ecx, [ebp + 0x44]
call fcn.004012b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004012b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x60
Function at 0x41008a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4b00e8
call fcn.0049dfc4
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xe4], bl
jne 0x4101b1
mov dword [ebp - 0x10], ebx
push 0x20019
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00403674
test eax, eax
jne 0x41019c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x200
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x4e57c0
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x24]
push eax
call fcn.00411399
push ebx
lea eax, [ebp - 0x14]
push 1
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0x2e
call fcn.00401db4
push eax
lea eax, [ebp - 0x38]
push ebx
push eax
lea ecx, [ebp - 0x24]
call fcn.00402476
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00410f26
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004012b4
lea ecx, [ebp - 0x24]
call fcn.00402f35
push 0xa
push dword [ebp - 0x20]
call fcn.004113c0
pop ecx
cmp eax, 5
pop ecx
jge 0x410191
push ebx
push str.Update_Service
push str.FLEXnet_Connect_requires_Internet_Explorer_5.0_or_later.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004012b4
cmp dword [ebp - 0x10], ebx
je 0x41018d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4101b3
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.004012b4
cmp dword [ebp - 0x10], ebx
mov byte [esi + 0xe4], 1
je 0x4101b1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41102b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4b026c
call fcn.0049dfc4
sub esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esp
jne 0x411054
mov dword [ebp + 0xc], 0x409
jmp 0x411064
cmp dword [ebp + 0xc], 0xc1a
jne 0x411064
mov dword [ecx + 0x10], 0x81a
push dword [ebp + 0xc]
call fcn.0041114a
mov esi, eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x411137
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411137
xor eax, eax
mov ecx, dword [ebp + 8]
and ecx, 0xf
cmp eax, ecx
jae 0x4110bc
movzx ecx, word [esi]
inc eax
lea esi, [esi + ecx*2 + 2]
jmp 0x4110a8
test esi, esi
je 0x411137
movzx ebx, word [esi]
lea eax, [ebx + ebx + 2]
push eax
call fcn.0049e01f
mov edi, eax
pop ecx
lea eax, [ebx + ebx]
add esi, 2
push eax
push esi
and word [eax + edi], 0
push edi
call fcn.0049e1e0
add esp, 0xc
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x14]
push edi
mov dword [ecx + 0xc], eax
call fcn.00491430
pop ecx
mov al, 1
jmp 0x411139
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x411c8d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b03a8
call fcn.0049dfc4
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.0049f012
mov eax, 0x4c340c
lea edi, [ebx + 0x10]
mov esi, eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], ecx
mov ecx, ebx
mov dword [ebx], 0x4be874
mov dword [ebx + 0xc], eax
call fcn.00411d7b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4