joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21004e90
Capabilities:
Encode data using xor

Disassembly:
pop es
jp 0x21004e76
dec ebp
fcmovnbe st(0), st(3)
bound esp, qword [ebx - 0x7a]
jnp 0x21004e4c
inc esp
sbb edx, 0x389c02c1
fst qword [ecx + 0x16]
pushfd
add byte [edi - 0x2643d871], 0xa
add esp, eax
xchg esi, eax
or dl, ah
adc eax, 0x41f2980d
les edx, [esi + 0xd15d40a]
cwde
inc ecx
loop 0x21004e6b
invalid
jo 0x21004e55
outsd dx, dword [esi]
iretd

Function at 0x21009c50
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
mov esi, eax
stosb byte es:[edi], al
fisubr word [ebp + 0x12]
xchg edi, eax
out dx, al
jge 0x21009c9f
test al, 0x3e
loope 0x21009c7f
shl byte [eax - 0x33], 1
invalid
xchg word [edi - 0x74], si
les eax, [esi + 0x11]
fstp xword [esi - 0xe0939a8]
jl 0x21009c35
or al, 0x80
mov esi, 0xa45abce8
shr ecx, 0x3f
pop ebp
lodsd eax, dword [esi]
mov ch, 0x5a
mov ss, word [esi + edx*4 + 0x457188d]
lea eax, [edi + 0x5b6f1087]
loopne sym.retapi.dll_RetOpenEventLog
mov dword [0xd5e4a6d2], eax
in al, 0xd5
out 0x27, eax
dec ecx
hlt
mov eax, dword [0x5f0a2743]
xchg dword [ebx - 0x5801a74a], esi
scasd eax, dword es:[edi]
mov byte [edi], al
dec ecx
jnp 0x21009cd1
out 0xb5, eax
cmp ebx, ebx
sbb dh, byte [edx]
clc
stosd dword es:[edi], eax
xchg dword [esi], esp
pop es
and ecx, ebx
stosd dword es:[edi], eax
mov edx, 0xc2503bb3
mov dword [edi - 0x1362a6cd], esp
add dl, ch
invalid
aam 0x9d
out dx, eax
xchg esp, eax
dec ecx
mov dl, 0x70
clc
lcall 0xe599, 0xb450614f
inc edi
sub dword [ebx + edi*8], 0x32
xlatb
fst dword [edi]
or dword [eax], edx
sti
mov cl, 0x9d
xchg byte [edi + 0x30], al
or byte [ebx + ecx*8 - 0x46d6ad5f], ch
adc edx, dword [edi - 0x30]
mov byte [esi], 0xe4
inc ebp
or al, 0xb1
and dh, cl
test byte [ebx + edx], dl
pop edx
popal
inc ebx
aad 0xe6
lea edi, [0xc82c7a10]
xchg edi, eax
adc dl, byte [ecx]
out dx, al
sub ah, ah
lea eax, [ebp + 0x54]
neg bh
dec edx
mov ecx, 0xd708e9c5
push ds
jle 0x21009d2a
je 0x21009d9e
sti
xchg edi, eax
xchg ecx, eax
test ah, ah
imul eax, dword [edi + 0x5b], 0xffffff98
in al, 0x6b
inc edi
pop ebx
cwde
arpl word [eax + 0x270e032c], cx
out 0xd9, eax
shl byte [ebp + 0x30], 1
push ss
invalid
push esp
adc esp, ebp
sub ch, byte [ecx - 0x5e689143]
cmpsb byte [esi], byte es:[edi]
int 0xb7
mov dword [0x7da31893], eax
das
scasb al, byte es:[edi]
sal dword [ebx], 0x8d
aas
invalid
Function at 0x21011880
Capabilities:
Encode data using xor

Disassembly:
push esp
cld
aad 0xce
ja 0x210118ac
push eax
insb byte es:[edi], dx
push ebp
mov bh, dh
daa
into
jns 0x210118fc
test byte [eax - 0x65], ch
cmpsb byte [esi], byte es:[edi]
push ecx
dec eax
mov bh, 0x2e
xchg esi, eax
xchg dword [ecx + esi*4 + 0x323871a8], esp
sub bl, byte [0xf87f6249]
mov dl, 0x8c
inc edx
pop ebx
sub byte [esi + 0x4e20baf3], 0x3c
clc
mov edx, 0xf83c4e20
jns 0x2101192c
sar byte [ebx + 0x789c04f5], 1
mov dl, 0xb3
push esp
mov byte gs:[0x901fad69], al
cmp eax, 0xac060be7
test byte [edx + 0xa], 0xd0
or dl, al
push ds
mov ebx, edi
je 0x210118dc
call 0xc4b1c4e7
lodsb al, byte [esi]
lahf
loope 0x210118ca
test dword [edi - 0x7a], 0x127d81d4
adc dl, byte [esi]
inc ecx
cmpsb byte [esi], byte es:[edi]
dec edi
xchg ah, dl
cmp dword [ebp + 0x12], 0xa6411612
dec ebp
ja 0x2101195f
outsb dx, byte [esi]
inc ebp
pop ebp
iretd
aad 0x2a
invalid
adc al, 0x65
ljmp 0x51f3
sub dh, dh
inc edx
sbb dword [edi], 0x79
mov esp, 0xf2e7f6e
and ah, bl
xchg esp, eax
pop edi
and ebx, dword [esi + eax + 0x7c]
js 0x2101198b
or al, 0x60
and edi, dword [ecx - 0x67c6f94b]
pop ebx
push ecx
adc esp, ecx
invalid
in al, dx
je 0x210119aa
xor al, 0xe5
invalid
movsd dword es:[edi], dword [esi]
rol dword [eax - 0x22], 1
sbb dword [edi], 0xffffffc2
arpl word [ebx + 0x75c46d09], bp
nop
sub byte [edi - 0x42], 0xef
in al, dx
sbb bl, bl
xor eax, esp
ja 0x21011a20
dec esi
out dx, al
leave
dec edi
or eax, ecx
dec esp
add dword [edx + 0x6f], eax
adc esp, dword [ebp + 0x2464871c]
pop edx
adc dword [ecx + 0x6b6d3c58], 0x4d
pushal
xor dword [eax - 0x57], esp
xchg esp, eax
xchg ecx, eax
push eax
pushal
sbb ebp, dword [edi + ebx*8]
jne 0x210119b8
fiadd word [esp + ebx*4]
ret 0xcd07
loope 0x21011a36
xchg esi, eax
mov byte [edx + 0x47], dl
and dword [ecx + 0x39], ebx
invalid
jb 0x21011a4a
mov dword [ebx - 0x6b], edx
jmp dword [ebx + 0x72]
xchg byte [ebx], cl
or byte [ecx - 0x10], bh
nop
adc eax, 0x6b90e21c
div byte [esi]
push ss
salc
lds esi, [ebp - 0x2467511e]
loopne 0x21011ac7
pop eax
enter 0xffffffffffffc2ed, 0xffffffffffffffb3
adc al, 0xde
or ah, byte [0x3208e320]
jno 0x21011a22
sal dword [edx - 0x6cdfce6a], 1
invalid
into
xchg esi, eax
adc ah, byte [ecx + 0x5ac3cc2a]
loop 0x21011b3c
mov al, byte [0xa44ad19e]
daa
push esi
packsswb mm4, qword [esi + 0x1cd5e546]
sbb byte [ebx + 0x234abca4], bh
invalid
sbb al, 0x34
mov ch, 0xc1
push cs
xchg esi, eax
or dword [esi + 0x4a], ebp
pop ds
jns 0x21011b99
test edi, ebp
push ebx
inc esi
sar dword [edx + esi*4 - 0x38], cl
fisubr word [esi - 0x71]
iretd
adc al, 0xd2
pushal
iretd

Function at 0x2101a390
Capabilities:
Encode data using xor

Disassembly:
inc eax
cmp ebx, dword [ebx + 0x7cb693ce]
push ebp
mov word [eax], es
push edi
mov eax, dword [0x18f73d30]
xor dword [ecx - 0x2a], 0x60298e54
js 0x2101a391
jmp 0x9881fa67
Function at 0x2101b3d0
Capabilities:
Encode data using xor

Disassembly:
push edx
std
push cs
jmp [ebp + 0x35870]
in eax, 0xda
mov ah, 0x5e
pop esi
into
xchg ecx, eax
add byte [esi], cl
pushfd
js 0x2101b3bd
cld
sbb al, 0xa2
aam 0xc8
jp 0x2101b30e
cmp dword [ecx], eax
sbb esp, ecx
xor dword [ecx - 0x54fcdd20], ebx
xchg edx, eax
nop
in al, 0x50
or dword [eax + 0x17], ecx
adc eax, esi
inc esi
div dword [esi]
clc
invalid
dec ebp
scasb al, byte es:[edi]
cli
xchg edx, eax
js 0x2101b368
sbb eax, 0xf68c9647
pop ebx
cdq
or al, 0x3f
push eax
mov bl, 0xdd
mov ebx, 0xea389a73
jae 0x2101b36c
cmp dl, ch
jae 0x2101b36c
cmp dl, ch
fucomi st(1)
push eax
sbb ebx, dword [ebp + 0x5abae815]
mov bh, 0x76
aaa
sbb ebx, esi
loopne 0x2101b3bc
adc byte [ebp - 0x71], ah
xchg ecx, eax
imul byte [esi]
outsb dx, byte [esi]
adc ebx, edx
jnp 0x2101b420
pop esp
not esp
add byte [ebp + 0x1e3fc532], 0x9f
retf 0xe553
aaa
not al
add eax, 0x264166c8
mov al, 0x77
invalid

Function at 0x21022290
Capabilities:
Encode data using xor

Disassembly:
pop esp
xchg ebp, eax
test al, 0x1e
mov eax, dword [0x7a1adc80]
push 0x4d24185
outsd dx, dword [esi]
sub dword [edx - 0x33], edx
sbb ch, dh
xor cl, ch
mov ch, 0xae
invalid
jecxz 0x21022261
cwde
insd dword es:[edi], dx
adc eax, 0xb3bbd905
hlt

Function at 0x210254d7
Capabilities:
Packed with generic packer

Disassembly:
das
nop
pushal
nop
pushfd
test esp, esp
jne 0x210254e2
mov dword [0xa167649d], 0x408b0030
or al, 0x90
popfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
nop
pushfd
test esp, esp
jne 0x210254f3
mov dword [0xc408b9d], 0x901c408b
popfd
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
nop
pushfd
test esp, esp
jne 0x21025502
mov dword [0x23eb619d], 0xb909090
sal byte [esp + ebx - 0x80], 0x38
das
je 0x21025517
popfd
popal
jmp 0x21025529
jmp 0x21025529
int3
jmp 0x21039000
Function at 0x425810
Capabilities:
Encode data using xor

Disassembly:
sahf
jnp 0x42584c
cli
add dword [edx + eax - 0x68824d74], edx
adc byte [edx + 0x2a], 0xf0
stosb byte es:[edi], al
aaa
pop ecx
pop eax
sal dword [edx - 0x1d], cl
sub al, 0xdd
dec ecx
xchg edx, eax
aaa
inc edi
cli
daa
outsb dx, byte [esi]
sub al, byte [edx - 0x6afaf96c]
out dx, eax
in al, 0x43
in al, dx
adc dword [ecx], eax
mov edi, dword [ebp - 0x17b835d8]
dec ecx
ret
xchg ebx, eax
sahf
sub ch, 0xcc
pushal
adc al, 0xe6
and ebp, ebx
xor byte [ecx - 0x5f], cl
jno 0x425823
in eax, dx
int3
or ch, bl
sbb dword [edx + eax*4 - 0x2c], esi
jns 0x4257ca
adc ah, 0x79
mov dword [0xe4aeb260], eax
scasd eax, dword es:[edi]
pushal
mov dl, 0xae
in al, 0xaf
in eax, dx
pop ecx
xor dword [esi], ecx
mov cl, 0x4e
push eax
lodsb al, byte [esi]
jl 0x425840
ljmp 0x63ef:0x83a4761e
jge 0x42586e
test al, 0x8e
sbb al, 0x3d
inc edx
or byte [edi], 0xca
cmp eax, 0xca0f8042
insb byte es:[edi], dx
add byte [ebp - 0x14d78ec], 0xba
push es
adc eax, 0x8687fa71
sub ecx, esi
jmp 0xc1a710eb
test dword [edi + eax*4], edx
mov dl, 0xfe
mov edx, 0xfa711506
xchg dword [esi - 0x731631d5], eax
mov eax, 0x17acc164
jmp 0x4691d884
sbb dword [esi], 0x41
xor al, 0x9a
and al, 2
test eax, 0x9643d1c9
loopne 0x4258b4
jb 0x42589b
sbb edi, dword cs:[ebx - 0x660ff0d5]
mov ebx, 0x99f00f2b
inc ecx
stc
sub byte [esi], al
dec esi
sbb byte [eax], cl
jbe 0x425813
out 9, al
movsb byte es:[edi], byte [esi]
mov edx, 0xe0171dc5
add bh, bh
lahf
xchg edx, eax
sub dword [bx + si], esp
sub dword [eax], esp
and ebx, ecx
jp 0x425845
hlt
jb 0x425880
push eax
fbld tbyte [edi]
pop esi
and esp, dword [0xe81842c4]
xchg ebp, eax
push cs
xor eax, dword [0x833043c6]
inc eax
nop
invalid
Function at 0x401d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4ad28c], 0
je 0x401d2c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4ad290]
test eax, eax
jne 0x401d4b
push 0x18
call fcn.004521ed
add esp, 4
mov ecx, eax
call fcn.00401c20
mov dword [0x4ad290], eax
cmp dword [eax + 0x14], 8
jb 0x401d53
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4ad28c], eax
cmp eax, 0xffffffff
je 0x401d77
test eax, eax
jne 0x401d1c
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x401e1d
cmp eax, 0x104
ja 0x401e1d
mov ecx, dword [0x4ad290]
lea eax, [ebp - 0x20c]
push eax
call fcn.004028f0
mov ecx, dword [0x4ad290]
call fcn.00402840
cmp word [eax], 0x5c
je 0x401dd4
push 0x4a5330
call fcn.004028a0
mov ecx, dword [0x4ad290]
push str.debug.log
call fcn.004028a0
mov eax, dword [0x4ad290]
cmp dword [eax + 0x14], 8
jb 0x401deb
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4ad28c], eax
cmp eax, 0xffffffff
je 0x401e13
test eax, eax
jne 0x401d1c
mov dword [0x4ad28c], 0
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x401f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.00406e70
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.00404c10
mov eax, dword [0x4ad288]
test eax, eax
je 0x401fc9
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x4020c8
cmp dword [ebx], 2
jl 0x40200d
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
push 2
call fcn.0045d0d3
add esp, 4
push eax
push 1
push esi
push edi
call fcn.0045db92
push 2
call fcn.0045d0d3
add esp, 0x14
push eax
call fcn.0045d32b
add esp, 4
lea esi, [ebx + 0xc]
lea edi, [ebx + 8]
call fcn.00401d00
test al, al
je 0x40203c
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x4ad28c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x4020c8
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x402074
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004562a0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.004141b0
add esp, 4
cmp dword [0x4ad298], 0
je 0x4020be
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00404c10
lea eax, [esp + 0x28]
push eax
call dword [0x4ad298]
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, 0x10
jb 0x4020c8
inc eax
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2c]
call fcn.00404d90
jmp 0x4020c8
cmp byte [0x4ae1f0], 0
jne 0x40211a
int3
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x4020e0
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.00404d90
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.00402b40
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.00453bb1
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
push 1
call fcn.0045f9a6
int3
Function at 0x408560
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x4ad2a4], 0
je 0x40858e
xor al, al
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
push 0x34
call fcn.004521ed
add esp, 4
mov ecx, eax
push 0
call fcn.004081a0
mov dword [0x4ad2a4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 8]
call fcn.004029b0
mov ecx, dword [0x4ad2a4]
lea eax, [esp + 4]
push eax
call fcn.00409110
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x4085de
inc eax
lea ecx, [esp + 4]
push eax
push dword [esp + 8]
call fcn.004065a0
mov ecx, dword [esp + 0x1c]
mov al, 1
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret

Function at 0x409110
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, 0x4a55f8
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409152
sub ecx, edx
lea eax, [esp + 0xc]
sar ecx, 1
mov edx, 3
push ecx
push 0x4a55f8
push eax
mov ecx, esi
call fcn.0040f620
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x4091b9
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.00408630
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x4091d1
inc eax
lea ecx, [esp + 0xc]
push eax
push dword [esp + 0x10]
call fcn.004065a0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 4

Function at 0x40dae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x40db3b
mov ecx, esi
jmp 0x40db40
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x40db65
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x40db4f
mov eax, dword [eax]
jmp 0x40db33
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40dfb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov esi, dword [ebx + 4]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
lea edx, [ecx*8]
add eax, edx
mov dword [esp + 0x14], edx
lea ecx, [ebx + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
cmp esi, eax
je 0x40e03c
mov esi, dword [esp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x40e03c
mov ecx, dword [edi]
nop dword [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x40e081
cmp esi, eax
jne 0x40e030
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x40e06a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x40e0a4
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x40e0c6
push dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0040dc10
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x40e0ac
mov dword [ecx], edi
jmp 0x40e0c6
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x40e0c6
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0040e0e0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x410000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 8], 4
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0
push dword [ebp + 8]
mov dword [esp + 0x20], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x410076
mov ecx, dword [esp + 4]
cmp ecx, 4
je 0x410059
cmp ecx, 3
jne 0x410071
cmp dword [esp + 8], 4
jne 0x410071
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov esp, ebp
pop ebp
ret 8
Function at 0x410080
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.00452be0
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4101c7
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x410154
cmp word [esp + 0x10], ax
jne 0x410118
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.004042a0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410120
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004042a0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x4101c2
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x4101a7
cmp eax, 0x400
ja 0x4101a7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.004028f0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8

Function at 0x4101e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
lea edi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410200
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4102d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
or eax, 0x20019
push esi
mov esi, ecx
push esi
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410322
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x410335
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi], 0
mov word [esi + 8], ax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 4]
mov edx, dword [esi]
dec ecx
mov dword [esi + 4], ecx
test edx, edx
je 0x41036f
test ecx, ecx
js 0x41036f
lea eax, [esp + 8]
mov dword [esp + 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x410375
xor eax, eax
mov word [esi + 8], ax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4109c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
lea ecx, [esi + 4]
mov dword [esi], 0x4a5520
call fcn.00416640
mov al, byte [ebp + 8]
mov byte [esi + 0x100], al
mov dword [esi + 0x104], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0x104], eax
cmp eax, 0xffffffff
jne 0x410a0b
mov byte [0], 0
mov eax, dword [0x4ad2fc]
test eax, 0xfffffffe
jne 0x410a3c
push 0x4ad2fc
call fcn.00415dd0
add esp, 4
test al, al
je 0x410a3c
mov dword [0x4ad300], 0
mov dword [0x4ad2fc], 0x4ad300
mov eax, dword [0x4ad2fc]
lea ecx, [esi + 0x10c]
mov dword [esi + 0x108], eax
call fcn.00410fd0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x414570
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00415830