joyce8/EMBER2024-capa huggingface dataset:
Function at 0x642a5063
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x642a5165
jmp 0x642a5256
jmp 0x642a5347
jmp 0x642a5438
jmp 0x642a5529
jmp 0x642a561a
jmp 0x642a570b
jmp 0x642a57fc
jmp 0x642a58ed
jmp 0x642a59de
jmp 0x642a5acf
jmp 0x642a5bc0
jmp 0x642a5cb1
jmp 0x642a5da2
jmp 0x642a5e93
jmp 0x642a5f84
jmp 0x642a6075
jmp 0x642a6166
jmp 0x642a6257
jmp 0x642a6348
jmp 0x642a6439
jmp 0x642a652a
jmp 0x642a661b
jmp 0x642a670c
jmp 0x642a67fd
jmp 0x642a68ee
jmp 0x642a69df
jmp 0x642a6ad0
jmp 0x642a6bc1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x642a6cb8
jmp 0x642a6da9
jmp 0x642a6e9a
jmp 0x642a6f8b
jmp 0x642a707c
jmp 0x642a716d
jmp 0x642a725e
jmp 0x642a734f
jmp 0x642a7440
jmp 0x642a7531
jmp 0x642a7622
jmp 0x642a7713
jmp 0x642a7804
jmp 0x642a78f5
jmp 0x642a79e6
jmp 0x642a7ad7
jmp 0x642a7bc8
jmp 0x642a7cb9
jmp 0x642a7daa
jmp 0x642a7e9b
jmp 0x642a7f8c
jmp 0x642a807d
jmp 0x642a816e
jmp 0x642a825f
jmp 0x642a8350
jmp 0x642a8441
jmp 0x642a8532
jmp 0x642a8623
jmp 0x642a8714
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x642a881f
jmp 0x642a8910
jmp 0x642a8a01
jmp 0x642a8af2
jmp 0x642a8be3
jmp 0x642a8cd4
jmp 0x642a8dc5
jmp 0x642a8eb6
jmp 0x642a8fa7
jmp 0x642a9098
jmp 0x642a9189
jmp 0x642a927a
jmp 0x642a936b
jmp 0x642a945c
jmp 0x642a954d
jmp 0x642a963e
jmp 0x642a972f
jmp 0x642a9820
jmp 0x642a9911
jmp 0x642a9a02
jmp 0x642a9af3
jmp 0x642a9be4
jmp 0x642a9cd5
jmp 0x642a9dc6
jmp 0x642a9eb7
jmp 0x642a9fa8
jmp 0x642aa099
jmp 0x642aa18a
jmp 0x642aa27b
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x642aa375
jmp 0x642aa466
jmp 0x642aa557
jmp 0x642aa648
jmp 0x642aa739
jmp 0x642aa82a
jmp 0x642aa91b
jmp 0x642aaa0c
jmp 0x642aaafd
jmp 0x642aabee
jmp 0x642aacdf
jmp 0x642aadd0
jmp 0x642aaec1
jmp 0x642aafb2
jmp 0x642ab0a3
jmp 0x642ab194
jmp 0x642ab285
jmp 0x642ab376
jmp 0x642ab467
jmp 0x642ab558
jmp 0x642ab649
jmp 0x642ab73a
jmp 0x642ab82b
jmp 0x642ab91c
jmp 0x642aba0d
jmp 0x642abafe
jmp 0x642abbef
jmp 0x642abce0
jmp 0x642abdd1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x642abedb
jmp 0x642abfcc
jmp 0x642ac0bd
jmp 0x642ac1ae
jmp 0x642ac29f
jmp 0x642ac390
jmp 0x642ac481
jmp 0x642ac572
jmp 0x642ac663
jmp 0x642ac754
jmp 0x642ac845
jmp 0x642ac936
jmp 0x642aca27
Function at 0x6036d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b9000]
push edi
or ebp, 0xffffffff
jmp 0x6036f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6036f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6036e8
mov eax, 1
add ebx, ebx
jne 0x60370b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x60371c
jne 0x60372c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60372c
dec eax
add ebx, ebx
jne 0x603728
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x603700
xor ecx, ecx
sub eax, 3
jb 0x603744
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6037b6
sar eax, 1
mov ebp, eax
jmp 0x60374f
add ebx, ebx
jne 0x60374f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x60375c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x603780
inc ecx
add ebx, ebx
jne 0x60376c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x603761
jne 0x60377d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x603761
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6037a0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x603791
jmp 0x6036ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6037a0
add edi, ecx
jmp 0x6036ee
pop esi
mov edi, esi
mov ecx, 0x2a1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6037be
cmp byte [edi], 0x15
jne 0x6037be
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x6037c3
lea edi, [esi + 0x200000]
mov eax, dword [edi]
or eax, eax
je 0x603832
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2094b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x209564]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6037f0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x209568]
or eax, eax
je 0x60382c
mov dword [ebx], eax
add ebx, 4
jmp 0x60380d
call dword [esi + 0x20956c]
popal
jmp 0x45b99c
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x408937
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
and eax, edi
sub edi, eax
call fcn.00408959
or eax, edi
xor dword [ecx], esi
dec edi
and eax, eax
inc ecx
add eax, eax
and eax, edi
cmp ecx, edx
jne fcn.00408937
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401490
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x10
mov eax, 0x415e3c
call fcn.004109a3
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
call fcn.00401f84
push eax
lea ecx, [ebp - 0x14]
call fcn.00401d98
mov esi, 0xf6
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x14]
call fcn.004022d5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00401bfc
test esi, esi
je 0x4014e2
cmp esi, 0xf6
jbe 0x4014f8
mov esi, 0x41b87c
push esi
call fcn.004075c2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00401cd7
call fcn.00401f84
push eax
lea ecx, [ebp - 0x10]
call fcn.00401d98
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
push edi
mov edi, dword [ebp - 0x14]
jmp 0x401528
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401573
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push eax
push 0x41bacc
push edi
lea eax, [ebp - 0x10]
push str._s_s_d.tmp
push eax
call fcn.00401a34
mov esi, dword [ebp - 0x10]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401513
push ecx
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.0040193d
pop ecx
lea ecx, [esi - 0x10]
call fcn.00402350
lea ecx, [edi - 0x10]
call fcn.00402350
mov eax, ebx
call fcn.00410971
ret
push 0x41b9dc
mov ecx, ebx
call fcn.00401c28
jmp 0x40155b

Function at 0x40175a
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebx
push esi
mov esi, dword [0x420568]
mov ebx, ecx
push edi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
movzx eax, di
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x40178d
pop edi
pop esi
xor edx, edx
mov ecx, eax
pop ebx
jmp fcn.004016ea
push 0
mov edx, edi
mov ecx, ebx
call fcn.00401731
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x40179d
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
push ecx
push dword [0x420568]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x401814
lea edx, [ebp - 4]
mov ecx, eax
call fcn.004016ea
mov esi, eax
test esi, esi
je 0x401814
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401814
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40180b
mov al, 1
jmp 0x401816
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40201a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402073
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402064
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x402060
cmp esi, ecx
jae 0x402064
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x402050
cmp esi, ecx
jb 0x402068
xor eax, eax
jmp 0x402072
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402734
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0xa0]
cmp dword [ecx - 0xc], eax
je 0x402764
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x402c44
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
call fcn.00402734
test al, al
jne 0x402cb2
cmp byte [ebx + 0xa4], al
je 0x402ca7
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [ebx + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x3f9
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x3fc
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x3fb
push dword [ebx + 4]
call edi
push 5
push eax
call esi
pop edi
pop esi
jmp 0x402cb2
push 6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop ebx
ret 0x10
Function at 0x40488d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x4048d9
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x404904
shr ecx, 2
test cl, 1
je 0x40490c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40493b
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x40493b
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x41623b
call fcn.00410a42
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x406ea7
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x406ea7
call fcn.004036dc
mov esi, eax
jmp 0x406fb2
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x406eca
call fcn.004036dc
jmp 0x406fa5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x406ec0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0x406efd
mov esi, 0x8007000e
jmp 0x406fa7
xor eax, eax
mov byte [ebp - 4], 2
shld eax, ecx, 1
add ecx, ecx
cmp eax, esi
ja 0x406f36
cmp ecx, 0xffffffff
ja 0x406f36
cmp ecx, 0x400
jbe 0x406f28
push ecx
lea ecx, [ebp - 0x418]
call fcn.004058f5
jmp 0x406f54
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x406f54
push 0x80070216
call fcn.0040230d
mov eax, 0x406f46
ret
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x406ef3
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x406ec0
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00406cd3
mov esi, eax
test edi, edi
je 0x406fb2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x406fcb
lea ecx, [ebp - 0x418]
call fcn.004058e0
mov eax, esi
call fcn.00410994
ret 0x10
Function at 0x41078b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040d384
mov dword [ebp - 0x14], eax
cmp dword [0x421468], esi
jne 0x41087e
push 0x800
push esi
push 0x41b798
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41080b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41095e
push esi
push esi
push 0x41b798
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41095e
push 0x41b7b0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41095e
push eax
call ebx
push 0x41b7bc
push edi
mov dword [0x421468], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42146c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x421470], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421478], eax
test eax, eax
je 0x41087b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421474], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4108a3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410896
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4108b8
push 4
pop eax
jmp 0x410960
cmp dword [ebp - 0x14], esi
je 0x4108b8
push dword [0x421468]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41089d
mov eax, dword [0x421474]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410916
cmp dword [0x421478], edi
je 0x410916
push eax
call ebx
push dword [0x421478]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410916
test eax, eax
je 0x410916
call ecx
test eax, eax
je 0x41090b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41090b
test byte [ebp - 8], 1
jne 0x410916
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410946
mov eax, dword [0x42146c]
cmp eax, edi
je 0x410943
push eax
call ebx
test eax, eax
je 0x410943
call eax
mov esi, eax
test esi, esi
je 0x410943
mov eax, dword [0x421470]
cmp eax, edi
je 0x410943
push eax
call ebx
test eax, eax
je 0x410943
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x421468]
call ebx
test eax, eax
je 0x41095e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410960
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040743d
mov esp, ebp
pop ebp
ret
Function at 0x40664b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
movzx eax, cl
mov esi, edx
push 0x405aa0
sub eax, 0x7fffffff
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406688
jle 0x4066e5
movzx eax, ax
or eax, 0x80070000
jmp 0x4066e5
or dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push 0x32
pop eax
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esi
call fcn.00406a46
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x405a88
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00406a20
test esi, esi
je 0x4066d8
jle 0x4066d4
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x4066e5
mov eax, dword [ebp - 8]
dec eax
neg eax
sbb eax, eax
and eax, 0x8000ffff
pop edi
pop esi
leave
ret

Function at 0x406898
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x405a6c
push 0x4059f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4068bf
push 0x800
call eax
call fcn.004064af
mov byte [ebp - 1], al
call fcn.004062aa
mov ecx, eax
test ecx, ecx
je 0x40694f
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0xc]
mov dl, byte [ebp - 1]
add eax, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004066e9
mov esi, eax
pop ecx
test esi, esi
js 0x40693f
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x406911
call fcn.0040644c
mov esi, eax
jmp 0x40693f
push 0x405a90
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x406933
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov esi, eax
jmp 0x406938
mov esi, 0x80004005
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 8]
call fcn.00406baa
pop edi
mov eax, esi
pop esi
leave
ret 0x10
push 0x80004005
call fcn.00406105
int3

Function at 0x40cfbd
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40cff4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40cfdb
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40cfec
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40cff6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40cfd1
xor eax, eax
pop edi
pop esi
ret