joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10362f96
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
neg ch
push word [esp + 0x1f]
pop ax
push bx
sub esp, 0x19
jmp 0x10362fbd
mov al, 0x43
pop dx
jmp 0x10362f70
xchg di, dx
bsf ebx, ebx
push bx
push word [esp]
mov bx, 0xaa43
xchg word [esp], si
jmp 0x10362fd4
lea esp, [esp + 0x50]
mov esi, dword [esp]
lea esi, [ebx*4]
bswap edi
xchg ebp, edx
lea ecx, [edx + esi]
jmp 0x10362f9c
mov esi, dword [esp + 3]
lea edx, reloc.RASAPI32.dll_RasHangUpA
xchg edi, ebx
mov esi, 0xfe1176ef
mov word [esp + 1], dx
mov al, 0xc8
jmp 0x10363f1c
bts eax, esi
add ebp, ebx
xchg dx, si
mov esi, 0xc3ae0f04
bswap ebp
rcl edx, 0x1b
jmp 0x10363023
pop edi
mov ebp, dword [esp]
mov ebx, dword [esp]
mov word [esp], si
xchg byte [esp], dh
lea esp, [esp + 1]
jmp 0x10362ff3
mov bx, ax
mov dx, cx
mov ebx, ebp
mov ecx, dword [esp]
mov bh, byte [esp]
sub dx, 0xe9f5
jmp 0x10363181
mov byte [esp + 1], bh
mov ah, 0x65
mov dword [esp], esi
clc
mov ebp, dword [esp + 3]
cpuid
jmp 0x1036300f
lea edx, [esi*4]
mov dx, 0x9344
add esp, 9
lea esp, [esp + 2]
not ah
mov edx, dword [esp]
jmp 0x10363099
lea esi, reloc.RASAPI32.dll_RasHangUpA
inc ah
rdtsc
mov byte [esp + 1], ah
push ax
rdtsc
jmp 0x1036304e
mov al, 0x92
stc
dec dx
mov dl, byte [esp]
mov si, bp
call fcn.103630fa
push ebx
insb byte es:[edi], dx
jo 0x10363099
xchg edi, eax
xchg esi, ebx
xchg byte [esp], cl
neg bp
cpuid
neg bp
jmp 0x10363083
pop word [esp]
sub esp, 3
not esi
cpuid
lea esp, [esp]
sub esp, 3
jmp 0x1036306f
cld
cpuid
sub esp, 5
mov word [esp + 1], cx
pop word [esp + 1]
push dx
jmp 0x103630ba
btc bx, dx
mov dl, byte [esp]
mov byte [esp], dl
not ch
lea esi, [esp + ebx]
mov al, bl
jmp 0x1036314a
lea edx, [ecx*4]
xchg dword [esp], eax
cpuid
bswap eax
mov word [esp + 1], dx
xchg ah, bh
jmp 0x1036303c
cld
pop word [esp]
mov edx, 0x644d5d1e
lea edi, [eax*4]
mov ax, 0xb813
xchg word [esp + 3], cx
jmp 0x103634f6
rdtsc
cpuid
setg dh
push ebp
lea ebp, reloc.RASAPI32.dll_RasHangUpA
mov dword [esp + 2], ebp
jmp 0x1036372f
Function at 0x103630cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ebx, 0x908bb617
xchg word [esp + 0x15], ax
mov eax, dword [esp]
jmp 0x10363115
rdtsc
sub esp, 0x1d
xchg word [esp + 0x13], ax
cpuid
jmp 0x1036312d
lea esp, [esp + 8]
sub esp, 0x17
xchg word [esp + 0x13], bx
mov bl, byte [esp + 0x15]
lea esp, [esp + 7]
xchg esi, ebp
jmp 0x103630ff
xchg word [esp + 0x2c], cx
mov bl, ah
cpuid
xchg byte [esp + 0x11], bl
bsf dx, bp
jmp 0x10363161
lea eax, [ebp*4]
cmp dx, 0x790c
mov dword [esp + 0x18], esp
mov di, sp
rdtsc
rcr bh, cl
jmp 0x10363336
setge bh
pop ebp
xchg byte [esp + 2], bh
call fcn.10363194
lea eax, [ebp - 0xfb]
lea ecx, reloc.RASAPI32.dll_RasHangUpA
add esp, 0xd
jmp 0x103631e2
bswap ecx
bts cx, sp
lea esp, [esp]
setle bl
mov ax, word [esp]
jmp 0x10363224
mov dword [esp], edx
push dx
inc eax
mov bx, 0xa89c
lea esi, [eax*4]
mov ah, dh
jmp 0x103631aa
pushal
neg dx
pop word [esp + 4]
mov byte [esp + 7], bl
pop dx
std
jmp 0x103632a1
shl bx, cl
mov edx, 0xc4d8be05
mov dh, 0x78
shl dl, 2
mov bh, dl
neg ax
jmp 0x1036320e
mov bp, word [esp + 8]
pop ax
pop dword [esp + 4]
bswap ebp
jmp 0x10363277
clc
bsf bp, bx
xchg byte [esp + 1], dl
dec di
pop si
xchg byte [esp + 0xd], ch
jmp 0x10363238
pop edx
mov word [esp + 5], ax
mov ebp, dword [esp + 1]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x1036328a
mov bl, byte [esp + 6]
xchg edi, ebp
mov ax, 0x6e41
btr si, bp
stc
mov edx, esi
jmp 0x10363261
mov bp, 0xbff1
xchg dword [esp + 2], ecx
mov cl, 0xf6
neg ebp
xchg word [esp + 3], si
jmp 0x103632bb
pop dword [esp + 7]
mov dx, word [esp + 7]
pop word [esp + 0xe]
xchg byte [esp + 9], dh
pop dx
xchg byte [esp + 0x12], cl
jmp 0x1036324e
lea edi, reloc.RASAPI32.dll_RasHangUpA
inc si
lea edi, [edi*4]
xchg byte [esp + 6], al
mov bh, dh
btc esi, ecx
jmp 0x10363308
xchg bp, ax
adc dx, 0x46ce
mov si, bx
sub esp, 4
xchg dword [esp], esi
ror ax, cl
jmp 0x103631f9
add esp, 2
bts edx, esp
xchg ecx, ebx
mov dword [esp], eax
call fcn.1036331d
out 0xe, eax
cdq
clc
invalid
cld
rdtsc
mov ebx, 0x8ccdc0b5
mov edi, 0x2ba08230
mov cl, bl
bsf ax, dx
jmp 0x103632f2
lea ebx, [edi - 0xb1]
add esp, 3
sub esp, 0x17
lea esp, [esp + 0x51]
mov ax, word [esp]
pushfd
jmp 0x103632da

Function at 0x10363961
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.RASAPI32.dll_RasHangUpA
call fcn.1036392c
inc edi
je 0x10363997
imul ebp, dword [ebp + 0x53], reloc.RASAPI32.dll_RasHangUpA
cmp eax, 0x2474880c
mov byte [esp + 1], dh
jmp 0x10363918
jmp 0x1036398d
inc edi
je 0x103639aa
jne 0x103639db
jb 0x103639d0
outsb dx, byte [esi]
je 0x103639be
jb 0x103639df
arpl word [ebp + 0x73], sp
jae 0x10363975
lahf
out 0x66, al
mov edx, 0x3486ce75
and al, 0x8d
and al, 0x24
jl 0x1036399b
add byte [eax], al
inc edi
je 0x103639f5
jb 0x10363a15
imul ebp, dword [edi + 0x6e], reloc.RASAPI32.dll_RasHangUpA
je 0x103639cf
and al, 1
add edi, esi
ror byte [ebp - 0x72f7db9c], 1
adc al, 0x1a
or al, 0x24
mov ah, byte [0x5a66c754]
and eax, 0x5a66c754
or eax, dword [edx + reloc.RASAPI32.dll_RasHangUpA]
and al, 0x8b
add al, 0x24
mov ecx, dword [esp]
cdq
lodsd eax, dword [esi]
pop esi
invalid
aam 0x8b
push esp
and al, 0x20
Function at 0x10366da5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 1]
mov word [esp + 9], ax
pop word [esp + 0x10]
jmp 0x10366d6e
lea esp, [esp + 2]
lea esp, [esp + 0x18]
pushal
not edi
mov eax, edi
not al
jmp 0x10366dda
call 0x10366da5
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor ebp, dword cs:[esi]
xor ebp, dword [esi]
xor byte [eax], al
pushfd
pushal
mov byte [esp + 4], cl
clc
jmp 0x10366d52
std
mov eax, 0x8042cea7
mov eax, 0xb61223f6
rcr dx, cl
xchg ebx, eax
jmp 0x10366e20
adc bl, 9
mov bp, 0x4ce9
mov eax, 0x2587d8d2
rdtsc
xchg bh, dl
xchg ecx, edx
jmp 0x10366dc4
mov ebx, 0x3e65b24
setbe cl
bsf ebp, eax
cpuid
ror dl, cl
jmp 0x10366e4f
mov bl, byte [esp]
dec bl
cpuid
clc
std
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x10366dee
xchg bx, ax
sub cl, 0x24
mov si, 0x91b9
mov dx, word [esp]
mov bx, word [esp]
mov esi, 0x11888fb2
jmp 0x10366e04
ror bx, cl
mov bx, ax
mov bh, al
rdtsc
pushfd
pop edi
jmp 0x10366e63
mov bx, word [esp]
mov esi, ebp
inc edx
bsf edx, ebp
lea edx, [edx*4]
std
jmp 0x10366e39
btc ebp, ebp
mov dx, ax
pushal
mov edi, dword [esp + 0x1b]
mov eax, 0x8c350001
bsr esi, esp
jmp 0x10366ec7
stc
btc dx, bx
rdtsc
bsf esi, esi
xchg esi, ebx
bsf cx, di
jmp 0x10366ef8
dec ah
cmc
mov eax, 0x9b4bc16e
xchg ebp, edi
neg edi
bsf eax, edi
jmp 0x10366e92
not bp
popal
lea ecx, reloc.RASAPI32.dll_RasHangUpA
xchg di, bx
mov eax, 0xca4b271d
lea esi, reloc.RASAPI32.dll_RasHangUpA
jmp 0x10366ea8
mov ch, byte [esp]
inc cl
sub esp, 6
lea ebx, [ebx*4]
cld
jmp 0x10366f0c
not bp
lea ebx, [esp + eax]
mov si, bp
mov ah, byte [esp]
bsf ax, ax
add bh, ch
jmp 0x10366ee2
pop word [esp]
xor bx, cx
xchg bh, al
mov byte [esp], ch
mov dh, byte [esp + 1]
jmp 0x103670cf
sub esp, 7
mov dword [esp + 5], ebx
pop dword [esp + 2]
neg bx
bswap eax
call fcn.10366f36
mov word [esp + 0xa], dx
mov byte [esp + 8], ch
sub esp, 0x1d
mov bp, word [esp + 1]
mov dx, 0x2462
mov ax, 0xdcd1
jmp 0x10366fd5
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov edi, 0x91d7e595
shl ah, 1
mov word [esp + 2], bx
push dword [esp + 4]
mov ebp, dword [esp + 4]
jmp 0x10366f5b
neg ecx
pop bp
mov al, 0xa
ror bx, cl
mov ebx, 0xbd17c57c
sub esp, 0x1c
jmp 0x10366ffe
xchg word [esp + 0x20], bx
pop bx
mov eax, dword [esp + 9]
rdtsc
sub dh, bh
not ebx
jmp 0x10366fb4
lea esp, [esp + 0x45]
bswap eax
call 0x10366fe8
mov eax, 0x47b4ad3d
movsd dword es:[edi], dword [esi]
mov cl, byte [esi]
pushfd
sti
push ss
clc
sbb byte [ebx + 0x4aa55633], ah
bsr bx, dx
bsr ebx, edx
lea ecx, [ebx + ebx]
mov edx, 0x10e0da6b
xchg word [esp], dx
mov byte [esp + 3], dh
pop ax
jmp 0x10366f98
push word [esp + 1]
shr ebp, 0x1f
lea esp, [esp + 1]
xchg word [esp + 1], ax
push word [esp + 4]
mov ax, 0x6cab
jmp 0x1036701c
Function at 0x10367036
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1036708b
lea esp, [esp + 1]
neg ax
mov si, word [esp + 2]
bts ecx, edx
add cx, sp
std
jmp 0x103670b5
pop cx
sub ah, cl
pop si
rdtsc
lea eax, [ebx*4]
add esp, 2
jmp 0x10367062
push word [esp + 4]
mov dx, ax
mov edx, esi
mov si, ax
jmp 0x10367140
rdtsc
inc al
pushfd
pop ax
mov dh, ch
mov word [esp + 2], ax
jmp 0x1036709f
pop cx
not cl
lea edi, [esi + 0x3f]
mov dword [esp], eax
pop word [esp]
jmp 0x1036711b
xchg dword [esp + 2], ebx
mov al, ah
xchg ebp, eax
lea esp, [esp + 3]
lea ebx, [ebp + ebp]
mov ebx, 0x2a4b6fd4
jmp 0x103670ee
xchg word [esp], cx
mov byte [esp], al
sbb bl, al
mov esi, 0xabe9f277
xchg si, ax
bt ecx, edx
jmp 0x10367170
mov bp, 0xd3b6
xchg bl, cl
mov bx, 0x4b12
push word [esp + 1]
xchg ah, dl
lea edi, [esp - 0xaa]
jmp 0x10367104
mov dx, sp
cpuid
mov ah, cl
mov ebp, dword [esp]
inc cx
mov ebx, eax
jmp 0x10380f04
bswap ebx
cmc
setle dl
bswap eax
pop cx
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x1036715a
xchg bl, ah
bswap eax

Function at 0x103802be
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
lea edi, [ebp*4]
mov word [esp], dx
mov ah, 0xba
xchg ah, cl
add esp, 1
jmp 0x1038027d
pop esi
bswap ebp
jmp 0x10380293

Function at 0x10380643
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov word [esp + 2], ax
lea edx, [ecx*4]
pushfd
jmp 0x103805e0
mov ebp, ecx
sets bl
mov word [esp], dx
mov al, byte [esp + 9]
mov bl, 0xc0
neg ah
jmp 0x1038060d
lea ebp, [ebx*4]
lea edi, reloc.RASAPI32.dll_RasHangUpA
stc
sub esp, 4
pop di
rdtsc
jmp 0x103805be
lea ebp, reloc.RASAPI32.dll_RasHangUpA
xchg word [esp + 4], dx
mov bh, cl
rcr ch, cl
jmp 0x10380626
pop si
ror ch, 3
pop word [esp + 1]
xchg word [esp], di
lea edi, [esp + 0xbb]
xchg si, ax
jmp 0x103805f7
rdtsc
bswap edi
mov cx, 0xc8d0
xchg word [esp], cx
bswap eax
mov word [esp + 4], dx
jmp 0x10380669
mov bh, ch
lea esi, [ecx + edx]
cld
mov word [esp + 2], dx
jmp 0x10380596
pop ecx
cmc
mov ax, 0x619
setle ah
mov dword [esp + 2], eax
cmp bp, sp
jmp 0x10380730
inc ecx
xchg al, bh
not ebp
push dword [esp + 2]
mov ah, byte [esp]
push sp
jmp 0x10380653
lea edx, [edx + ebp]
sub esp, 0xb
add esp, 1
mov al, 0x2a
cpuid
jmp 0x103806e2
mov ebp, eax
mov dword [esp + 7], eax
mov eax, 0x65c3617d
pop dword [esp]
pop word [esp + 3]
mov dword [esp + 3], eax
jmp 0x10380699
xchg byte [esp], cl
bswap esi
or ebp, edi
btr bx, di
mov dl, 0xa2
std
jmp 0x1038070d
pop dword [esp + 7]
btr ebp, edx
not esi
add esp, 9
bsf ecx, edi
mov bp, 0xb544
jmp 0x103806c8
bt dx, di
setle ah
lea ebp, [ecx + esi]
add esp, 1
jmp 0x10380d32
lea eax, [esi + edi]
lea ebp, [ebp - 0xe3]
mov bp, 0xa70c
bswap ebp
bsr ebp, esp
bsf ecx, ebp
jmp 0x103806f7
mov byte [esp + 7], ch
push bp
push dword [esp + 6]
rdtsc
neg ax
dec ax
jmp 0x103806af
mov dword [esp], ecx
mov edx, 0x51644699
call fcn.10380a87
xchg word [esp + 1], bp
xchg bl, al
xchg ebx, eax
sbb ebp, 0xe0486ef4
xchg word [esp], di
mov di, ax
jmp 0x10380c7f

Function at 0x10380934
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], cl
mov dh, byte [esp + 3]
neg ch
jmp 0x10380959
Function at 0x103809a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x11
mov al, 0xde
rcl ebp, 0xc
lea esp, [esp + 2]
lea edi, [ecx + ebx]
jmp 0x103808df
lea ebx, [ecx + edi]
pop word [esp + 0x14]
dec edi
pop edx
rdtsc
mov si, 0xcf29
jmp 0x10380893
std
or dh, bl
xchg byte [esp + 5], ah
setp ch
rdtsc
add esp, 6
jmp 0x1038094a
mov bx, sp
sub esp, 8
lea edx, reloc.RASAPI32.dll_RasHangUpA
lea ebx, [edi + edi]
add dl, ah
lea esp, [esp + 6]
call fcn.103808bb
xchg dl, bl
cpuid
btr di, bx
mov dword [esp], edi
mov si, dx
xchg byte [esp + 4], al
jmp 0x103808bd
mov byte [esp + 0x18], dh
xchg esi, ecx
mov ah, ch
push word [esp + 0xb]
mov bl, cl
pop edi
jmp 0x103808a9
bsr dx, bp
cmp al, bh
mov bx, 0x75ce
call fcn.10380934
xchg word [esp + 1], di
clc
mov al, byte [esp + 2]
rdtsc
rcr edi, 0x1b
sub esp, 0xd
jmp 0x10380989
mov dh, 0x71
rdtsc
xchg word [esp + 2], bp
sub esp, 0x11
push dword [esp + 0xf]
mov ax, 0xebea
jmp 0x1038091f
dec esi
mov ebx, dword [esp + 0xa]
mov bp, si
pop bp
mov ax, 0xd5f8
push word [esp + 7]
jmp 0x103809c7
xchg byte [esp + 2], ch
jmp 0x10380973
bsr ebp, esi
xchg cx, bp
pushal
mov byte [esp + 0xc], al
rdtsc
add esp, 0x23
jmp 0x103809dc
dec ch
rdtsc
bswap ecx
pop word [esp]
lea ecx, [esi*4]
mov dl, al
jmp 0x103809af
setg al
bswap edi
cpuid
push word [esp + 0xc]
pushfd
pop word [esp + 3]
jmp 0x10380a11

Function at 0x10380a64
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf bp, di
mov bh, byte [esp + 0xe]
mov ebx, dword [esp + 0xe]
setns ah
jmp 0x10380a66
jmp 0x10380a4e
mov si, word [esp + 8]
xchg edx, ebx
mov ebp, dword [esp + 8]
pop word [esp + 9]
xchg ah, al
lea ecx, [ebx*4]
jmp 0x10380bfc
xchg si, ax
xchg word [esp + 3], bx
xchg dh, cl
mov dword [esp + 2], eax
rdtsc
jmp 0x10380b86
mov edx, 0x819617e
rdtsc
bswap ecx
mov di, bx
cld
sub esp, 0xe
jmp 0x10380a94
cpuid
lea eax, reloc.RASAPI32.dll_RasHangUpA
setnp dh
add esp, 0xa
pop dx
add esp, 2
jmp 0x10380aaa
xchg dword [esp + 2], ebp
mov ebx, eax
rdtsc
bswap ebp
not dx
call fcn.10380aed
inc bx
mov dword [esp + 6], eax
pop bp
mov byte [esp + 0xa], al
cpuid
mov si, 0xb893
jmp 0x10380b14
mov ebp, 0xcd4229af
bswap eax
cld
seto dl
rdtsc
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x10380ac1

Function at 0x10380d95
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ecx
push dword [esp + 3]
mov byte [esp + 1], ch
jmp 0x10380df9
lea esp, [esp + 5]
lea esp, [esp + 3]
mov dword [esp + 0x24], esi
call fcn.10380dd5
or eax, 0xe1f6ef9c
pushal
pop dword [esp + 2]
mov dword [esp + 0x28], ebp
push dx
push edx
push ax
jmp 0x10380da0

Function at 0x10380db6
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.10366cc0
mov dword [esp + 4], esp
call fcn.10380d95
pushal
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
jmp 0x10380ddf
mov eax, dword fs:[0x30]
jmp 0x10380e41
mov eax, dword [eax + 8]
push eax
jmp 0x10366cbb
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x10380e1f

Function at 0x10380dd5
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push esp
mov byte [esp + 4], bh
pop dword [esp]
jmp 0x10380dbf
Function at 0x401050
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 5
push eax
push ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x401070
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
push esi
lea eax, [esp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoft.NETFrameworkpolicy
push 0x80000002
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401159
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
call edi
cmp eax, 0x103
je 0x401134
mov edi, edi
push 1
lea ecx, [esp + 0x18]
push 0x40b188
push ecx
call fcn.004017da
add esp, 0xc
test eax, eax
jne 0x401108
push 4
lea edx, [esp + 0x19]
push edx
push ebp
call fcn.00401591
add esp, 0xc
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
add esi, 1
push esi
push edx
mov dword [esp + 0x30], 0x100
call edi
cmp eax, 0x103
jne 0x4010e0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004017f1
add esp, 0x10c
ret
mov ecx, dword [esp + 0x110]
pop esi
pop ebp
xor ecx, esp
xor al, al
call fcn.004017f1
add esp, 0x10c
ret
Function at 0x401200
Capabilities:
Get common file path

Disassembly:
sub esp, 0x34c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x368]
push 0xff
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system32mscoree.dll
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x260]
push str._s_s
push edx
call fcn.004019ec
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x64
mov ebp, eax
call fcn.00401982
push 0x64
mov esi, eax
call fcn.00401982
push 0x64
push 0
push esi
mov ebx, eax
call fcn.00401a70
push 0x64
push 0
push ebx
call fcn.00401a70
add esp, 0x20
cmp ebp, 0xffffffff
je 0x4012e7
lea edx, [esp + 0x14]
push edx
call fcn.00401070
add esp, 4
test al, al
je 0x4012e7
lea eax, [esp + 0x14]
push 0x40b208
push eax
call section..text
add esp, 8
test al, al
je 0x4012e7
push ebx
push esi
push edi
call fcn.00401180
mov eax, esi
add esp, 0xc
mov ebp, str..Trader
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4012d3
sub eax, edx
jne 0x40131e
mov esi, str.SysFrame.exe
jmp 0x40131e
mov eax, edi
mov ebp, str..FW
mov esi, str.GNNTVM.exe
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4012f6
sub eax, edx
jne 0x40130a
mov ebx, str...TraderSysFrame.exe
jmp 0x40131e
push edi
push str...Trader_
push str._s_s
push ebx
call fcn.004019ec
add esp, 0x10
push ebx
push esi
push ebp
call fcn.00401050
mov ecx, dword [esp + 0x364]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004017f1
add esp, 0x34c
ret 0x10

Function at 0x4017f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4017fb
repz ret
jmp fcn.0040314a
Function at 0x408675
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402985
xor ebx, ebx
cmp dword [0x40fa44], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40874a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4086b5
xor eax, eax
jmp 0x40880e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4086ae
push eax
call fcn.00402922
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40fa44], eax
call esi
push eax
call fcn.00402922
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40fa48], eax
call esi
push eax
call fcn.00402922
mov dword [0x40fa4c], eax
lea eax, [ebp - 8]
push eax
call fcn.0040431a
test eax, eax
pop ecx
pop ecx
je 0x408718
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402e5f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40874a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402922
cmp eax, ebx
pop ecx
mov dword [0x40fa54], eax
je 0x40874a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402922
pop ecx
mov dword [0x40fa50], eax
mov eax, dword [0x40fa50]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4087c3
cmp dword [0x40fa54], esi
je 0x4087c3
push eax
call fcn.0040298e
pop ecx
call eax
cmp eax, ebx
je 0x408790
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40fa54]
call fcn.0040298e
pop ecx
call eax
test eax, eax
je 0x408790
test byte [ebp - 0x18], 1
jne 0x4087c3
lea eax, [ebp - 0xc]
push eax
call fcn.00404351
test eax, eax
pop ecx
je 0x4087ab
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402e5f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4087ba
or dword [ebp + 0x10], 0x200000
jmp 0x4087f4
or dword [ebp + 0x10], 0x40000
jmp 0x4087f4
mov eax, dword [0x40fa48]
cmp eax, esi
je 0x4087f4
push eax
call fcn.0040298e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4087f4
mov eax, dword [0x40fa4c]
cmp eax, esi
je 0x4087f4
push dword [ebp - 4]
push eax
call fcn.0040298e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40fa44]
call fcn.0040298e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003abf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44c
mov eax, 0x1000b8dd
call fcn.1000aaab
lea eax, [ebp - 0x414]
push eax
xor ebx, ebx
push 1
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x10003af7
xor al, al
call fcn.1000aaf5
ret
lea eax, [ebp - 0x41c]
push eax
push 1
push ebx
push str.SoftwareAdobeCommonFilesUsage
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
push dword [ebp - 0x414]
je 0x10003b24
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10003aef
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x414], eax
mov eax, dword [0x100117f0]
mov ecx, 0x100117f0
mov dword [ebp - 0x41c], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
mov dword [ebp - 4], ebx
push str.Agent
push dword [ebp - 0x414]
mov dword [ebp - 0x420], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003c34
lea eax, [ebp - 0x410]
push eax
push 0x1000ccf8
lea eax, [ebp - 0x418]
call fcn.10005aaa
mov eax, dword [ebp - 0x418]
cmp dword [eax - 4], 1
pop ecx
pop ecx
jle 0x10003bc4
push dword [eax - 0xc]
lea eax, [ebp - 0x418]
push eax
call fcn.10005291
mov eax, dword [ebp - 0x418]
push eax
lea ecx, [ebp - 0x43c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 1
call fcn.10006698
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call dword [0x1000c20c]
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push dword [ebp - 0x414]
call esi
mov dword [ebp - 0x414], ebx
mov bl, 1
lea eax, [ebp - 0x418]
call fcn.10005274
mov al, bl
jmp 0x10003af1
push dword [ebp - 0x414]
call esi
jmp 0x10003c22