joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd2a1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x983bd0]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4fd2e5
push 0xa
pop esi
cmp word [ebx], si
jne 0x4fd2e5
or byte [eax + edi + 0x28], 4
jmp 0x4fd2ea
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x4fd455
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x4fd42d
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x4fd337
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x4fd361
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x4fd380
push 0xa
pop ebx
cmp word [edx], bx
jne 0x4fd34e
push ebx
add eax, 4
pop edx
jmp 0x4fd356
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x4fd2fc
jmp 0x4fd455
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fd428
cmp dword [ebp - 0x14], 0
je 0x4fd428
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x983bd0]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x4fd404
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4fd3cc
mov word [esi], ax
jmp 0x4fd452
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x983bd0]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x983bd0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x983bd0]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x4fd452
cmp word [ebp - 4], ax
jne 0x4fd40e
cmp esi, ebx
je 0x4fd3c4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00507d9b
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4fd455
push 0xd
pop eax
jmp 0x4fd3c4
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x983bd0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4fd44f
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4fd455
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4fefbd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004efd30
mov eax, dword [0x97ffc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005034d6
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4fefff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4ff176
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004ef870
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1014], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x983bd0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00507d7d
mov ecx, dword [esi*4 + 0x983bd0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x1020], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4ff16f
cmp eax, dword [edi + ecx + 0x24]
jne 0x4ff16f
xor esi, esi
lea eax, [ebp - 0x101c]
push esi
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ff16f
push dword [ebp - 0x100c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00507d7d
add esp, 0x14
cmp edx, esi
jl 0x4ff16f
jg 0x4ff0ca
cmp eax, esi
jb 0x4ff16f
mov ebx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x101c]
cmp ebx, esi
jg 0x4ff16f
jl 0x4ff0ec
cmp dword [ebp - 0x1008], eax
ja 0x4ff16f
lea edi, [ebp - 0x1004]
xorps xmm0, xmm0
add edi, eax
movlpd qword [ebp - 0x1018], xmm0
lea ecx, [ebp - 0x1004]
cmp dword [ebp - 0x1008], esi
jne 0x4ff111
cmp ebx, esi
je 0x4ff156
mov edx, dword [ebp - 0x1014]
mov esi, dword [ebp - 0x1018]
cmp ecx, edi
jae 0x4ff156
mov al, byte [ecx]
cmp al, 0xd
jne 0x4ff137
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4ff143
cmp byte [ecx + 1], 0xa
jne 0x4ff143
inc ecx
jmp 0x4ff143
movzx eax, al
movsx eax, byte [eax + 0x980120]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4ff11d
cmp edx, ebx
jne 0x4ff11d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x1020]
jmp 0x4ff174
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004eee25
leave
ret
Function at 0x5043c3
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x5043dd
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x5043f4
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x50444c
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.00507ad5
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x50444c
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x50444c
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x50444c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x504446
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x504448
xor bl, bl
mov al, bl
jmp 0x50444e
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x507e7d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00507df9
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x507fec
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x507fec
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x507fa1
jg 0x507ed9
test eax, eax
je 0x507f97
push 1
push 0x1000
call fcn.00502c70
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x507efc
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x507f8e
push 0x8000
push ebx
call fcn.00500fea
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x507f25
jg 0x507f20
cmp ecx, 0x1000
jb 0x507f25
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00503fdf
add esp, 0x10
cmp eax, 0xffffffff
je 0x507f6a
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x507f20
jl 0x507f51
test ecx, ecx
jne 0x507f12
push dword [ebp - 0xc]
push ebx
call fcn.00500fea
push esi
call fcn.00502cd0
add esp, 0xc
xor ebx, ebx
jmp 0x507ffa
cmp byte [edi + 0x24], 0
je 0x507f81
cmp dword [edi + 0x20], 5
jne 0x507f81
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x507f8c
mov ebx, dword [edi + 0x18]
jmp 0x507f8e
xor ebx, ebx
push esi
call fcn.00502cd0
pop ecx
jmp 0x507ffa
test ecx, ecx
jg 0x507f63
jl 0x507fa1
test eax, eax
jae 0x507f63
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00507d9b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x507fc1
cmp byte [edi + 0x1c], 0
je 0x507f63
jmp 0x507ff2
push ebx
call fcn.00507ad5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x507f63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x507ffa
cmp byte [edi + 0x1c], 0
je 0x507ff7
mov ebx, dword [edi + 0x18]
jmp 0x507ffa
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00507d9b
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x509a2b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x509ac8
push ebx
push esi
call fcn.005099f4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0050998a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x509a75
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x509ac7
push edi
push eax
call fcn.00504590
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x509a95
call fcn.00502cd0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x509ac6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0050998a
add esp, 0x20
test eax, eax
jne 0x509ab4
push edi
call fcn.00502cd0
jmp 0x509abc
push ebx
call fcn.00502cd0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x509acb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x509adc
pop esi
ret
push ebx
push edi
push esi
call fcn.005099f4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00504590
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x509b04
push ebx
push esi
push edi
call fcn.004f06e0
add esp, 0xc
push 0
call fcn.00502cd0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x50a25b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00509d77

Function at 0x510670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51069d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51069d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4bbdca
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xef8b01e0
invalid
imul eax, dword [eax - 0x79], 0x6cc60374
pop es
add al, 0x85
in eax, dx
out dx, al
insb byte es:[edi], dx
cmp esp, dword [eax - 0x3125c8f5]
fcmove st(0), st(6)
fcmove st(0), st(6)
mov edi, 0xc0542121
fnstenv [esp - 0xc]
pop esi
xor ecx, ecx
mov cl, 0x88
xor dword [esi + 0x1a], edi
add esi, 4
add edi, dword [esi + 0x16]
loop 0x4bbdb9
lcall 0xb2ea, 0xd037789
fldcw word [ecx]
mov bh, 0x5c
or edi, ebx
xchg dh, bl
jp 0x4bbd9a
cli
frstor dword [ecx + eax*2]
and al, 0x41
js 0x4bbdf9
xchg edx, eax
pop ebx
fcompp
test eax, 0x68a2367d
inc esi
invalid
Function at 0x4027b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575222
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x628f58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x224], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call fcn.00550660
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402845
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00402df0
push str.Foxit_Software
mov ecx, esi
call fcn.00402930
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x402879
mov ecx, dword [esi]
call fcn.004102c0
test eax, eax
jne 0x402891
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x40288c
mov ecx, dword [esi]
call fcn.00410390
push str.Foxit_PDF_Reader_
mov ecx, esi
call fcn.00402930
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4028a7
mov ecx, dword [esi]
call fcn.004102c0
test eax, eax
jne 0x4028bf
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4028ba
mov ecx, dword [esi]
call fcn.00410390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054a576
mov esp, ebp
pop ebp
ret
Function at 0x403f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x403f49
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403f5f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f56
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x403f92
nop
cmp esi, ecx
jae 0x403f56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x403f80
cmp esi, ecx
jae 0x403f56
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x4040ba
test eax, 0xffff0000
jne 0x4040ba
push esi
push edi
movzx edi, ax
push edi
call fcn.004119d7
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4040b6
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4040b6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4040b6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4040b6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404049
cmp esi, ecx
jae 0x4040b6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404037
cmp esi, ecx
jae 0x4040b6
movzx eax, word [esi]
test ax, ax
je 0x4040b6
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40407c
push edi
mov ecx, ebx
call fcn.004044c0
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40407f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00554a1c
add esp, 0x10
cmp eax, 0x50
ja case.0x40409d.1
movzx eax, byte [eax + 0x4040e8]
jmp dword [eax*4 + 0x4040d8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4040cd
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00411763
call fcn.00411749
push 0x80070057
call fcn.00404450
nop
movsb byte es:[edi], byte [esi]
inc eax
inc eax
add bl, al
inc eax
inc eax
add al, cl
inc eax
inc eax
add al, cl
inc eax
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575488
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x628f58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x218], esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d38
push 0x200
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00550660
add esp, 0xc
mov dword [ebp - 0x218], 0
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x21c]
lea eax, [ebp + 0x20]
mov dword [ebp - 0x21c], 0x1ff
cmovae eax, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404d38
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x404c30
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], 0
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c50
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00402df0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x404ca8
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404c9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d89
push edx
push ecx
call fcn.0054a587
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x404cf6
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404cec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d8e
push edx
push ecx
call fcn.0054a587
add esp, 8
mov edx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp edx, 8
jb 0x404d6d
mov ecx, dword [ebp + 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404d63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d93
jmp 0x404d63
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x404d53
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], 0
lea eax, [ebp + 0x38]
mov ecx, esi
push eax
call fcn.00403e40
jmp 0x404c6e
push edx
push ecx
call fcn.0054a587
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054a576
mov esp, ebp
pop ebp
ret
call fcn.00554319
call fcn.00554319
call fcn.00554319
int3
Function at 0x40e700
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea edi, [ecx + 4]
mov dword [ebp - 8], 0
push edi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e751
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40e760
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x628f58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
lea eax, [ebp - 0x20c]
push str._s_failed_w_err_0x_08lx
push eax
call fcn.0040e800
add esp, 0x10
mov dword [ebp - 0x214], 0
add edi, 4
mov dword [ebp - 0x210], 0
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e7ed
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054a576
mov esp, ebp
pop ebp
ret 8