joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cc9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x1001cce1
call fcn.1001e464
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001cce1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x1001cd24
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x1001cd0d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1001cd0d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1001cd21
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100477a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b9e30]
jne 0x100477aa
repz ret
jmp fcn.10051c4c

Function at 0x1006269d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100515f3
xor ebx, ebx
cmp dword [0x100be9ac], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10062772
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100626dd
xor eax, eax
jmp 0x10062836
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x100626d6
push eax
call fcn.10051590
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100be9ac], eax
call esi
push eax
call fcn.10051590
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100be9b0], eax
call esi
push eax
call fcn.10051590
mov dword [0x100be9b4], eax
lea eax, [ebp - 8]
push eax
call fcn.1004c4b2
test eax, eax
pop ecx
pop ecx
je 0x10062740
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10050264
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10062772
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10051590
cmp eax, ebx
pop ecx
mov dword [0x100be9bc], eax
je 0x10062772
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10051590
pop ecx
mov dword [0x100be9b8], eax
mov eax, dword [0x100be9b8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x100627eb
cmp dword [0x100be9bc], esi
je 0x100627eb
push eax
call fcn.100515fc
pop ecx
call eax
cmp eax, ebx
je 0x100627b8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100be9bc]
call fcn.100515fc
pop ecx
call eax
test eax, eax
je 0x100627b8
test byte [ebp - 0x18], 1
jne 0x100627eb
lea eax, [ebp - 0xc]
push eax
call fcn.1004c561
test eax, eax
pop ecx
je 0x100627d3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10050264
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x100627e2
or dword [ebp + 0x10], 0x200000
jmp 0x1006281c
or dword [ebp + 0x10], 0x40000
jmp 0x1006281c
mov eax, dword [0x100be9b0]
cmp eax, esi
je 0x1006281c
push eax
call fcn.100515fc
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1006281c
mov eax, dword [0x100be9b4]
cmp eax, esi
je 0x1006281c
push dword [ebp - 4]
push eax
call fcn.100515fc
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100be9ac]
call fcn.100515fc
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x536960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x54
push edi
mov edi, ecx
test eax, eax
jne 0x536989
push 0x44
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0051b430
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp + 0x10]
movzx eax, byte [ebp + 0x18]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x5369c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0x1c
push esi
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.00403470
push dword [ebp - 0xc]
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [edi + 8], eax
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4010c8
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
jmp 0x402b80
mov eax, 0x1084c
call fcn.00405ab0
push ebx
push ebp
push esi
push edi
push 0x1083d
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, eax
lea eax, [esp + 0x20]
mov edi, ecx
add esp, 4
xor ebp, ebp
xor ebx, ebx
sub edi, eax
mov eax, ebx
lea esi, [esp + ebx + 0x1c]
cdq
idiv dword [esp + 0x1086c]
mov eax, dword [esp + 0x10868]
mov byte [edi + esi], bl
inc ebx
cmp ebx, 0x1083d
mov dl, byte [edx + eax]
mov byte [esi], dl
jl 0x402baa
lea eax, [esp + 0x1c]
mov esi, ecx
sub eax, ecx
mov dword [esp + 0x10], 0x1083d
mov dword [esp + 0x14], eax
mov edi, 0x1083d
jmp 0x402bef
mov eax, dword [esp + 0x14]
mov bl, byte [esi]
xor edx, edx
mov dl, byte [eax + esi]
mov eax, ebx
and eax, 0xff
add ebp, edx
add eax, ebp
mov ebp, 0x1083d
cdq
idiv ebp
inc esi
mov ebp, edx
mov al, byte [ecx + ebp]
mov byte [ecx + ebp], bl
mov byte [esi - 1], al
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402beb
mov edx, dword [esp + 0x10864]
xor esi, esi
test edx, edx
jle 0x402ca5
mov ebx, dword [esp + 0x10870]
mov eax, dword [esp + 0x10860]
sub eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
lea eax, [edi + 1]
mov edi, 0x1083d
cdq
idiv edi
xor eax, eax
mov ebp, 0x1083d
mov edi, edx
mov al, byte [edi + ecx]
add eax, esi
mov esi, 0x1083d
cdq
idiv esi
mov esi, edx
mov dl, byte [edi + ecx]
mov al, byte [esi + ecx]
mov byte [esi + ecx], dl
mov byte [esp + 0x14], al
mov byte [edi + ecx], al
mov edx, dword [esp + 0x14]
xor eax, eax
mov al, byte [esi + ecx]
and edx, 0xff
add eax, edx
cdq
idiv ebp
mov al, byte [edx + ecx]
mov edx, dword [esp + 0x18]
xor al, byte [edx + ebx]
inc ebx
mov byte [ebx - 1], al
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402c45
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1084c
ret
Function at 0x401109
Capabilities:
Get common file path

Disassembly:
jmp 0x4051a0
push 0xffffffffffffffff
push 0x407528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push edi
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x405266
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push 0
call edi
test eax, eax
mov dword [ebx + 0x7c], eax
jne 0x405266
push esi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
push 0x104
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x405254
push 0x6a
push esi
call edi
test eax, eax
je 0x40524d
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebx + 0x7c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.004057fe
pop esi
mov ecx, dword [esp + 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40113b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4052c0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push ebx
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x405343
mov edx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x124]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret
mov eax, ebx
pop ebx
add esp, 0x10c
ret
Function at 0x401168
Capabilities:
Create process on windows

Disassembly:
jmp 0x405410
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
test ebp, ebp
je 0x405589
cmp byte [ebp], 0
je 0x405589
mov ecx, dword [esp + 0x218]
mov eax, str.open
test ecx, ecx
je 0x405445
mov eax, 0x40bd24
mov ecx, dword [esp + 0x214]
push ebx
push esi
push edi
push ecx
push 0
push 0
push ebp
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
ja 0x40557c
lea edx, [esp + 0x10]
push edx
push str..htm
push 0x80000000
call fcn.0040113b
add esp, 0xc
test eax, eax
jne 0x40557c
mov edi, str._shellopencommand
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x80000000
call fcn.0040113b
add esp, 0xc
test eax, eax
jne 0x40557c
mov esi, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x10]
push str.__1_
push edx
call esi
mov edx, eax
add esp, 8
test edx, edx
jne 0x405515
lea eax, [esp + 0x10]
push 0x40bcf8
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
jne 0x405515
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0xf]
jmp 0x405518
mov byte [edx], 0
mov edi, 0x40bcf4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x220]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
add esp, 0x208
ret
mov eax, 0x24
pop ebp
add esp, 0x208
ret
Function at 0x4011f9
Capabilities:
Get common file path

Disassembly:
jmp 0x4017f0
sub esp, 0x444
push ebx
push edi
mov edi, dword [esp + 0x460]
xor ebx, ebx
cmp edi, ebx
je 0x4019d9
mov ecx, dword [esp + 0x464]
cmp ecx, 0x104
jb 0x4019d9
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x1c], ebx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x24]
push esi
mov esi, dword [esp + 0x458]
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x460]
cmp eax, 0xffffffff
je 0x40186f
lea ecx, [esp + 0x14]
push ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40186f
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x45c]
cmp eax, ebx
je 0x4018be
mov ecx, eax
shr ecx, 0x10
jne 0x4018aa
and eax, 0xffff
push ebx
lea edx, [esp + 0x48]
push eax
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4018be
push 0x206
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
cmp byte [esp + 0x44], bl
jne 0x4018da
cmp dword [esp + 0x28], ebx
jne 0x4018da
lea ecx, [esp + 0x44]
push ecx
push 0x206
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x470]
mov eax, 1
cmp ecx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], eax
je 0x4018fb
mov eax, 0x11
mov dword [esp + 0x34], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x464]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x401a70
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
xor ebp, ebp
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov esi, eax
cmp esi, ebx
je 0x401989
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x24c]
push ecx
push esi
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x401989
mov edx, dword [esp + 0x46c]
mov ecx, dword [esp + 0x468]
dec edx
lea eax, [esp + 0x24c]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov ebp, 1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4019cc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4019cc
cmp esi, ebx
je 0x4019b3
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x4019c6
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebp
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x444
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x444
ret
Function at 0x401130
Capabilities:
Terminate process

Disassembly:
push esi
push 0x422a88
push str.__TI_Version:__ws_n
push 2
mov esi, ecx
call fcn.00404e8a
add esp, 4
push eax
call fcn.00401020
add esp, 0xc
push 0x4263a8
push str.__Usage:__s___help____fileversion____info____install____remove____DLLonly____nouninstall____force__n_n__________help_________Displays_usage_information._n__________fileversion__Displays_version_information._n__________info_________Displays_driver_installer_dialog._n__________install______Installs_the_driver_and_copies_DLLs._n__________remove_______Removes_the_driver._n__________DLLonly______Copies_the_DLLs_only._n__________nouninstall__For_use_with__install._n__________force________Ignores_driver_version_and_runs_action.__not_DLLs__n
push 2
call fcn.00404e8a
add esp, 4
push eax
call fcn.00401020
add esp, 0xc
push 2
call fcn.00404e8a
add esp, 4
push eax
call fcn.0040509c
add esp, 4
push esi
call fcn.00404cc9
int3
Function at 0x401960
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], edx
mov ebx, ecx
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x401a44
push edi
call fcn.0040d1f2
mov esi, eax
add esp, 4
test esi, esi
je 0x401a44
push esi
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x4019de
push str.error__no_fileversion_n
push 2
call fcn.00404e8a
add esp, 4
push eax
call fcn.004010c0
push esi
call fcn.0040d1ed
add esp, 0xc
push 2
call fcn.00404e8a
add esp, 4
push eax
call fcn.0040509c
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
mov dword [edi], 0
mov dword [ebx], 0
mov dword [eax], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x423208
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push esi
test eax, eax
je 0x401a3c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx eax, word [ecx + 0xa]
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edi], eax
movzx eax, word [ecx + 0xe]
mov dword [ebx], eax
movzx eax, word [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
call fcn.0040d1ed
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
mov eax, dword [0x426398]
or eax, 1
push eax
push 0
push str.SOFTWAREAladdin_Knowledge_SystemsHASPDriverInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401aa3
push 8
push 2
call fcn.00404db7
push str.0.0.0.0
mov esi, eax
push 8
push esi
call fcn.0040cf31
add esp, 0x14
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push str.Version
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a81
mov eax, dword [ebp - 4]
inc eax
push eax
push 2
call fcn.00404db7
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push str.Version
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401b00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2064
call fcn.0040cebc
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2050], 0x44
push esi
push 0x4265a8
lea eax, [ebp - 0x2008]
movlpd qword [ebp - 0x204c], xmm0
push 0x1000
push eax
mov esi, ecx
movlpd qword [ebp - 0x2044], xmm0
movlpd qword [ebp - 0x203c], xmm0
movlpd qword [ebp - 0x2034], xmm0
movlpd qword [ebp - 0x202c], xmm0
movlpd qword [ebp - 0x2024], xmm0
movlpd qword [ebp - 0x201c], xmm0
movlpd qword [ebp - 0x2014], xmm0
movups xmmword [ebp - 0x2060], xmm0
call fcn.0040cf31
add esp, 0xc
lea eax, [ebp - 0x2008]
push esi
push 0x1000
push eax
call fcn.0040cf95
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0
push eax
call fcn.00404cdf
add esp, 8
test eax, eax
jne 0x401bf2
lea eax, [ebp - 0x2060]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401bf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCreateProcess_failed___d__n
call fcn.00401050
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040292d
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.0041c430
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x200c], 0
push 0x4232dc
push esi
mov edi, edx
call fcn.0040d1d6
add esp, 8
test eax, eax
jne 0x401c6c
push esi
push 0x4232e0
call fcn.00401050
add esp, 8
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040292d
mov esp, ebp
pop ebp
ret
cmp dword [0x4263a4], 0
je 0x401c96
push edi
push esi
push str._ws_n_ws
call fcn.004010f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040292d
mov esp, ebp
pop ebp
ret
push 0x42334c
lea eax, [ebp - 0x2008]
push 0x1000
push eax
call fcn.0040cf31
add esp, 0xc
lea eax, [ebp - 0x2008]
push esi
push 0x1000
push eax
call fcn.0040cf95
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x42334c
push 0x1000
push eax
call fcn.0040cf95
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x423350
push 0x1000
push eax
call fcn.0040cf95
add esp, 0xc
lea eax, [ebp - 0x2008]
push edi
push 0x1000
push eax
call fcn.0040cf95
add esp, 0xc
mov dword [ebp - 0x2068], 0x44
lea eax, [ebp - 0x201c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2064], xmm0
movlpd qword [ebp - 0x205c], xmm0
push eax
lea eax, [ebp - 0x2068]
movlpd qword [ebp - 0x2054], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x2008]
movlpd qword [ebp - 0x204c], xmm0
push eax
push 0
movlpd qword [ebp - 0x2044], xmm0
movlpd qword [ebp - 0x203c], xmm0
movlpd qword [ebp - 0x2034], xmm0
movlpd qword [ebp - 0x202c], xmm0
movups xmmword [ebp - 0x201c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401ddc
push 0xffffffffffffffff
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x201c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2018]
call esi
mov eax, dword [ebp - 0x200c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040292d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2008]
push eax
call fcn.0040d10a
add esp, 4
test eax, eax
je 0x401dc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.004010f0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.0040292d
mov esp, ebp
pop ebp
ret
Function at 0x4145b6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414264
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x402240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404144], eax
mov ecx, ebp
add ecx, 8
mov dword [0x4040e2], ecx
mov dword [0x404148], 0x30
mov dword [0x40414c], 2
mov dword [0x404154], 0
mov dword [0x404158], 0
mov dword [0x404150], 0x4025d0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x40415c], eax
mov dword [0x404168], 0xf
mov dword [0x404170], 0x40386b
mov dword [0x4040da], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404160], eax
mov dword [0x404174], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404164], eax
push 0x404148
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040da]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.myform
push 0x40386b
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x40413c], eax
xor eax, eax
jmp 0x40232b
push eax
push dword [0x40413c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x40413c]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x404178
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402371
push 0x404178
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x404178
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402344
mov eax, dword [0x404180]
call fcn.00401208
ret