joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e8f5
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10014
call fcn.00411ac9
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x10010], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10014], eax
mov dword [ebp - 0x10008], edi
mov dword [ebp - 0x1000c], edi
call fcn.0040e855
mov esi, eax
test esi, esi
js 0x40ea03
lea eax, [ebp - 0x10008]
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [0x42e908]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e9be
push 0
lea eax, [ebp - 0x1000c]
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10010]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e99a
call edi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40ea03
cmp dword [ebp - 0x1000c], 0
push 0
jbe 0x40e9d8
push dword [ebp - 0x1000c]
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40e961
call edi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x40e961
jmp 0x40ea03
push dword [ebp - 0x10014]
xor esi, esi
push ebx
push 2
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x40ea03
call edi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 0x10008], 0
je 0x40ea18
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004119c3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ee69
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
test edi, edi
je 0x40eebe
cmp word [edi], ax
je 0x40eebe
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 0xc]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 3
add eax, esi
push eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.0040e463
mov esi, eax
test esi, esi
js 0x40f05f
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], ebx
jmp 0x40eef7
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
add eax, 3
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040e383
mov esi, eax
test esi, esi
js 0x40f05f
push 0xffffffffffffffff
push ebx
push 4
push dword [ebp - 4]
call fcn.00416833
lea eax, [ebx + 6]
add esp, 0x10
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push 0x5c
pop edx
mov dword [ebp - 0x10], edx
movzx eax, word [ecx]
cmp dx, ax
jne 0x40ef0e
cmp dx, word [ecx + 2]
je 0x40ef50
push 0x61
pop edx
cmp dx, ax
ja 0x40ef1e
push 0x7a
pop edx
cmp dx, ax
jae 0x40ef36
push 0x41
pop edx
cmp dx, ax
ja 0x40f058
push 0x5a
pop edx
cmp dx, ax
jb 0x40f058
push 0x3a
pop eax
cmp ax, word [ecx + 2]
jne 0x40f058
push 0x5c
pop eax
cmp ax, word [ecx + 4]
jne 0x40f058
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40ef6b
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0xc], eax
push ecx
call edi
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
lea edx, [ecx + eax*2]
movzx eax, word [edi]
mov dword [ebp + 8], edx
test ax, ax
je 0x40f062
mov ebx, dword [ebp + 0xc]
cmp word [ebp - 0x10], ax
jne 0x40ef97
cmp edi, ebx
je 0x40f047
push 0x5c
pop ecx
mov word [edx], ax
cmp cx, ax
jne 0x40f03e
push dword [ebp - 0xc]
xor eax, eax
mov word [edx + 2], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f00d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x40effb
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40eff7
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x40eff7
call esi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f05f
xor esi, esi
jmp 0x40f00d
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f05f
cmp dword [ebp + 0x18], 0
je 0x40f03b
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f03b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f05f
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add edx, 2
mov dword [ebp + 8], edx
add edi, 2
movzx eax, word [edi]
test ax, ax
jne 0x40ef89
jmp 0x40f062
mov esi, 0x80070057
jmp 0x40f062
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40f06c
push ecx
call fcn.0040e741
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40f178
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, 0x104
or edi, 0xffffffff
push ebx
push eax
call fcn.0040e5bb
mov esi, eax
test esi, esi
js 0x40f260
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x40f229
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
push str._s_S_05d._S
push eax
call fcn.0040e605
mov esi, eax
add esp, 0x18
test esi, esi
js 0x40f260
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f220
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070050
jne 0x40f21c
xor esi, esi
jmp 0x40f220
test esi, esi
js 0x40f260
inc ebx
cmp ebx, 0x3e8
jl 0x40f1b0
cmp dword [ebp + 0x10], 0
je 0x40f243
push 0xfde9
push 0
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.0040e4d7
mov esi, eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40f24c
mov dword [eax], edi
test esi, esi
js 0x40f254
test eax, eax
jne 0x40f260
cmp edi, 0xffffffff
je 0x40f260
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40f26e
push dword [ebp - 4]
call fcn.0040e741
cmp dword [ebp - 8], 0
je 0x40f27c
push dword [ebp - 8]
call fcn.0040e741
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f5a7
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40f634
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40f626
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f5da
mov esi, 0x80070005
jmp 0x40f634
test al, 0x10
je 0x40f5e5
mov esi, 0x8000ffff
jmp 0x40f634
test al, 7
je 0x40f634
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f613
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f634
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40f634
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x40f74d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x40f791
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f818
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x40f7a6
mov esi, 0x8007000e
jmp 0x40f818
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40f7cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f811
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x425774
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40f7fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40f811
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [ecx], edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fb0e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
mov esi, eax
xor ebx, ebx
add esi, esi
or edx, 0xffffffff
cmp dword [0x42ed10], ebx
jne 0x40fb6e
mov dword [0x42ed10], 1
mov ecx, ebx
push 8
mov eax, ecx
pop edi
test al, 1
je 0x40fb54
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fb56
shr eax, 1
dec edi
test edi, edi
jg 0x40fb47
mov dword [ecx*4 + 0x42e910], eax
inc ecx
cmp ecx, 0xff
jle 0x40fb42
mov ecx, dword [ebp + 8]
test esi, esi
je 0x40fb8a
movzx eax, byte [ecx]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x42e910]
inc ecx
sub esi, 1
jne 0x40fb72
mov ecx, dword [ebp - 4]
not edx
mov eax, edx
mov dword [ebp - 8], ebx
xor edx, edx
div dword [ecx + 0xc]
mov esi, edx
cmp dword [ecx + 0xc], ebx
jbe 0x40fbcc
imul edi, esi, 0xc
add edi, dword [ecx + 8]
cmp dword [ebp + 0xc], ebx
je 0x40fbda
cmp dword [edi + 4], ebx
je 0x40fbc8
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40fc09
mov ecx, dword [ebp - 4]
cmp dword [edi + 4], ebx
jne 0x40fbf2
cmp dword [edi], ebx
jne 0x40fbf2
xor ebx, ebx
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 4], ebx
je 0x40fc09
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40fc09
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ecx + 0xc]
jb 0x40fbfb
sub esi, dword [ecx + 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ecx + 0xc]
jb 0x40fba0
jmp 0x40fbcc
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
jmp 0x40fbcf
Function at 0x410d28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ecx, ecx
lea eax, [ebp + 0x10]
push eax
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], ecx
push dword [ebp + 8]
mov edi, ecx
push 0x900
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ebx, eax
test ebx, ebx
jne 0x410d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x410df1
test ebx, ebx
je 0x410db9
push 0
lea eax, [ebp - 8]
push eax
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp - 4]
add eax, edi
push eax
push dword [0x42e060]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x410df1
add edi, dword [ebp - 8]
cmp edi, ebx
jb 0x410d79
cmp dword [ebp + 0x14], 0
je 0x410df1
push 0
lea eax, [ebp - 8]
push eax
push 2
push dword [0x42e068]
push dword [0x42e060]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x410e00
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x410e0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
and dword [ebp - 8], edi
push eax
call fcn.0040e619
mov esi, eax
test esi, esi
js 0x410ebd
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
test ebx, ebx
je 0x410e84
push 0
lea eax, [ebp - 8]
push eax
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp - 4]
add eax, edi
push eax
push dword [0x42e060]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x410ebc
add edi, dword [ebp - 8]
cmp edi, ebx
jb 0x410e44
cmp dword [ebp + 0x10], 0
je 0x410ebc
push 0
lea eax, [ebp - 8]
push eax
push 2
push dword [0x42e068]
push dword [0x42e060]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop ebx
cmp dword [ebp - 4], 0
je 0x410ecb
push dword [ebp - 4]
call fcn.0040e741
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410f5a
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov eax, 0x104
cmp dword [0x42e060], 0xffffffff
push edi
mov dword [ebp - 0x420], eax
mov edi, str.unknown
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], esi
je 0x4110b4
cmp dword [0x42ed14], esi
je 0x4110b4
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x208
test eax, eax
jne 0x410fd0
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0041259b
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040f74d
test eax, eax
jns 0x410ffa
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x411023
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0041259b
add esp, 0xc
push esi
call fcn.0041166c
push eax
push str._Logging_started:__S_
push 1
call fcn.00411212
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x41c]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x20c]
push ecx
push eax
push str.Executable:__S_v_d._d._d._d_r_nComputer__:__S
push 1
call fcn.00411212
mov eax, dword [0x42e064]
add esp, 0x2c
pop ebx
sub eax, esi
je 0x41109d
sub eax, 1
je 0x411096
sub eax, 1
je 0x41108f
sub eax, 1
jne 0x4110a2
mov edi, str.debug
jmp 0x4110a2
mov edi, str.verbose
jmp 0x4110a2
mov edi, str.standard
jmp 0x4110a2
mov edi, str.none
push edi
push str.____logging_level:__s____
push 1
call fcn.00411212
add esp, 0xc
jmp 0x4110b7
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004119c3
mov esp, ebp
pop ebp
ret

Function at 0x4112a8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00416833
add esp, 0x10
cmp eax, 0x50
jne 0x4112e5
mov eax, 0x8007007a
jmp 0x411328
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, eax
test ecx, ecx
jne 0x411339
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00414cc4
pop ecx
pop ecx
test eax, eax
je 0x411318
xor ecx, ecx
mov word [eax], cx
cmp cx, word [eax + 2]
je 0x4112f9
cmp word [ebp - 0x20c], 0
je 0x411326
test eax, eax
jne 0x4112e5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004119c3
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
je 0x411352
cmp ecx, 3
je 0x411352
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x411354
xor eax, eax
cmp eax, 1
je 0x4112e5
jmp 0x411328
Function at 0x41135b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0x208], ecx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0x100
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x411436
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x41144b
push dword [ebp - 0x208]
call fcn.0041135b
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x41144b
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x41144b
jmp 0x41143e
cmp esi, 0x80070103
je 0x411449
test esi, esi
jne 0x41144b
xor ecx, ecx
jmp 0x41137b
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x411460
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004119c3
mov esp, ebp
pop ebp
ret 4

Function at 0x411474
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x41149e
xor esi, esi
inc esi
jmp 0x4114e5
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4114e5
push dword [ebp - 4]
call fcn.0041135b
mov esi, eax
test esi, esi
js 0x4114e5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x4114f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x401e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e67
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e98
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401e94
cmp esi, eax
jae 0x401e98
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x401e84
cmp esi, eax
jb 0x401e9e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451fed
mov eax, dword fs:[0]
push eax
sub esp, 0xc28
mov eax, dword [0x4668f0]
xor eax, esp
mov dword [esp + 0xc24], eax
push ebx
push esi
mov eax, dword [0x4668f0]
xor eax, esp
push eax
lea eax, [esp + 0xc34]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc], ebx
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
push ebx
mov eax, 0x45b3f8
mov esi, edi
mov dword [esp + 0x30], edi
call fcn.0042d9a0
mov dword [esp + 0xc3c], ebx
push ebx
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, ebx
je 0x402f38
push 0x400
lea ecx, [esp + 0x834]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x800
lea edx, [esp + 0x34]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402f52
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x34]
lea esi, [esp + 0x14]
call fcn.0042d9a0
push 0xffffffffffffffff
push ebx
mov eax, esi
mov ecx, edi
mov dword [esp + 0xc44], 1
call fcn.0042c6a0
cmp dword [esp + 0x28], 8
jb 0x402f9a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00434321
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xc34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xc24]
xor ecx, esp
call fcn.0043432c
add esp, 0xc34
ret

Function at 0x4030c0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x45dc48
push 1
push 0
push 0x45dc38
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40311f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x40311f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x40312f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
test eax, eax
je 0x40313f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret