joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x415140
mov esi, dword [ebp + 8]
test esi, esi
je 0x415140
cmp byte [esi], 0
je 0x415140
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x415140
cmp dword [ebp + 0x10], 0
mov dword [ebx], 0
jne 0x41509a
mov ecx, dword [edi + 8]
push 0
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x415140
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x415104
sub eax, 3
je 0x4150da
sub eax, 3
jne 0x415132
push 0x10
call fcn.0041b6f3
add esp, 4
test eax, eax
je 0x41512e
mov edx, dword [edi + 8]
push edx
push esi
mov ecx, eax
call fcn.00415fd0
mov dword [ebx], eax
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
push 0x10
call fcn.0041b6f3
add esp, 4
test eax, eax
je 0x41512e
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.00415ec0
mov dword [ebx], eax
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
push 0x10
call fcn.0041b6f3
add esp, 4
test eax, eax
je 0x41512e
mov edx, dword [edi + 8]
push edx
push esi
mov ecx, eax
call fcn.00415d60
mov dword [ebx], eax
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x415170
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
push edi
mov edi, dword [ebp + 8]
je 0x415230
mov eax, 0x80
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
mov edx, dword [esi + 0x14]
push 0
lea eax, [ebp - 0x108]
push eax
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x84]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x415230
inc dword [esi + 0x14]
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x41520d
cmp byte [ebp - 0x84], 0x5c
mov ecx, dword [esi + 8]
mov dword [edi + 4], ecx
lea ecx, [edi + 0xc]
jne 0x415201
lea edx, [ebp - 0x83]
push edx
jmp 0x415208
lea eax, [ebp - 0x84]
push eax
call fcn.004109d0
cmp dword [edi + 0x20], 0
jne 0x415219
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x1c], ecx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
Function at 0x415390
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
xor esi, esi
mov dword [ebp - 4], ecx
cmp dword [ecx + 0x20], esi
jne 0x4153ad
mov eax, 0x80040009
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, vtable.CWinRegKey.0
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.00410680
mov edi, 0x20019
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call fcn.00410680
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 8], esi
jne 0x415424
cmp byte [ebx], 0x5c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
jne 0x415412
lea edx, [ebx + 1]
push edx
jmp 0x415413
push ebx
call fcn.004109d0
cmp dword [ebp - 8], esi
jne 0x415424
mov dword [ebp - 0xc], 0xe
lea ecx, [ebp - 0x28]
call fcn.00415300
mov edi, eax
cmp edi, esi
jl 0x4154b5
cmp dword [ebp - 8], esi
je 0x41543e
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415170
test eax, eax
je 0x415481
mov edi, edi
cmp byte [ebp - 0x39], 0xff
lea eax, [ebp - 0x40]
jne 0x41545c
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415390
test eax, eax
jl 0x415481
cmp dword [ebp - 8], esi
je 0x415471
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415170
test eax, eax
jne 0x415450
cmp dword [ebp - 8], esi
je 0x415497
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x415497
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, esi
jle 0x4154b3
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov ebx, vtable.CWinRegKey.0
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x2c], esi
je 0x4154d3
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4154d3
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
call fcn.004108e0
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 8], esi
je 0x4154f4
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4154f4
mov dword [ebp - 8], esi
lea ecx, [ebp - 0x1c]
call fcn.004108e0
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x415dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call fcn.004108b0
cmp byte [edi + 0xf], 0xff
lea esi, [edi + 8]
mov eax, esi
jne 0x415df0
mov eax, dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push eax
mov eax, dword [edi + 4]
push eax
call ebx
test eax, eax
jne 0x415e5d
cmp dword [ebp - 8], 1
jne 0x415e5d
mov eax, dword [ebp - 4]
test eax, eax
je 0x415e4f
inc eax
cmp byte [esi + 7], 0xff
mov dword [ebp - 4], eax
jne 0x415e26
mov esi, dword [esi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00411230
push eax
mov eax, dword [edi + 4]
lea edx, [ebp - 8]
push edx
push 0
push esi
push eax
call ebx
test eax, eax
jne 0x415e5d
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
call fcn.004112c0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x415e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x415e80
lea edx, [ecx + 8]
sub eax, esi
cmp byte [edx + 7], 0xff
jne 0x415e94
mov edx, dword [edx]
push eax
mov eax, dword [ecx + 4]
push edi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebp
ret 4

Function at 0x416040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x416059
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
lea esi, [edi + 8]
mov dword [ebx], 0
cmp byte [esi + 7], 0xff
mov eax, esi
jne 0x41606d
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
lea edx, [ebp - 4]
push edx
push 0
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4160d8
cmp dword [ebp - 4], 7
jne 0x4160d8
mov eax, dword [ebp + 8]
test eax, eax
je 0x4160ca
inc eax
push eax
mov dword [ebp + 8], eax
call fcn.0041b6f3
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4160d8
cmp byte [esi + 7], 0xff
jne 0x4160b0
mov esi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push eax
mov eax, dword [edi + 4]
lea edx, [ebp - 4]
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4160d8
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push edi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x416724
cmp dword [ebp - 4], eax
jle 0x416724
push 0x18
call fcn.0041b6f3
add esp, 4
test eax, eax
je 0x4166d1
mov ecx, eax
call fcn.00411b00
jmp 0x4166d3
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
jne 0x4166ed
mov ecx, dword [ebp + 0x14]
pop esi
pop edi
mov dword [ecx], 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edx + 0x1c]
call eax
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x416ab7
cmp dword [ebp + 0x10], 0
je 0x416ab7
push esi
lea esi, [ecx + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4169b8
sub eax, edx
mov edx, eax
mov eax, edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4169c8
sub eax, edi
lea eax, [eax + edx + 2]
push ebx
push eax
call fcn.0041b440
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4169f3
pop ebx
pop esi
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov edx, ebx
mov dword [ebp - 8], 0xffffffff
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x416a00
mov edi, ebx
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416a10
mov cx, word [0x436504]
mov eax, dword [ebp + 8]
mov word [edi], cx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416a27
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416a33
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 0x210]
neg ecx
lea edx, [ebp - 4]
push edx
sbb ecx, ecx
push ebx
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x416aa2
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push eax
push esi
call edx
mov ecx, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push 1
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x416a98
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0041bd94
mov eax, dword [ebp - 8]
add esp, 4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416af0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [eax + 0x10]
mov eax, dword [eax + 0x210]
push edi
mov edi, dword [ebp + 8]
neg eax
lea ecx, [ebp - 0x208]
push ecx
sbb eax, eax
push edx
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x416b7d
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
mov esi, 1
jmp 0x416b40
movzx ecx, si
push ecx
push edi
lea edx, [ebp - 0x204]
push str._s_d
push edx
call fcn.0041e496
mov ecx, dword [ebp - 0x208]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push ecx
inc esi
call ebx
test eax, eax
je 0x416b40
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
Function at 0x416c10
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.00414f70
mov eax, dword [esi + 0x210]
neg eax
sbb eax, eax
add eax, 0x80000001
push eax
lea ecx, [ebp - 0x28]
call fcn.00414ff0
add esi, 0x10
push esi
lea ecx, [ebp - 0x28]
call fcn.00415010
push 0xe
lea ecx, [ebp - 0x28]
call fcn.00414fd0
lea ecx, [ebp - 0x28]
call fcn.00415300
mov esi, eax
test esi, esi
jl 0x416cb8
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
lea ecx, [ebp - 0x28]
mov esi, 0x80004005
mov dword [ebp - 4], 0
call fcn.00415040
test eax, eax
je 0x416ca4
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0xf], 0xff
lea eax, [ecx + 8]
jne 0x416c8d
mov eax, dword [eax]
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415150
lea ecx, [ebp - 0x28]
call fcn.00414fa0
lea ecx, [ebp - 0x28]
call fcn.004152d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x416d40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [edi], 0
mov ecx, dword [esi + 0x210]
neg ecx
lea eax, [ebp + 0xc]
push eax
sbb ecx, ecx
lea ebx, [esi + 0x10]
push ebx
add ecx, 0x80000001
push ecx
mov dword [ebp - 4], 0x80004005
mov dword [ebp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x416da4
cmp dword [esi + 0x210], 0
jne 0x416d9c
lea edx, [ebp + 0xc]
push edx
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x416e33
push 0x18
call fcn.0041b6f3
add esp, 4
test eax, eax
je 0x416dbb
mov ecx, eax
call fcn.00411b00
jmp 0x416dbd
xor eax, eax
mov dword [edi], eax
test eax, eax
jne 0x416ddb
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push 0x105
push eax
call edx
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x105
push eax
call edx
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x416e19
mov dword [ebp - 4], eax
jmp 0x416e29
mov eax, dword [edi]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi], 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x416ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov esi, ecx
call fcn.0041b6f3
mov edi, dword [ebp + 0x10]
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x417019
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0xc
push ebx
push 0
push eax
call fcn.0041b530
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jbe 0x417051
jmp 0x417030
xor edx, edx
mov eax, ecx
div dword [esi + 0x18]
mov eax, dword [esi + 0x14]
inc ecx
mov dl, byte [edx + eax]
mov eax, dword [ebp + 8]
add dl, bl
xor dl, byte [ecx + eax - 1]
mov eax, dword [edi]
mov byte [ecx + eax - 1], dl
cmp ecx, ebx
jb 0x417030
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x417ad0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push str.kernel32.dll
mov edi, ecx
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0xc0
mov byte [ebp - 0xa], 0xc2
mov byte [ebp - 9], 4
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x417b86
push esi
push 0x438834
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x417b85
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x417b85
cmp byte [ebp + 8], bl
je 0x417b35
add edi, 0xc0c
jmp 0x417b49
mov eax, dword [esi]
mov dword [edi + 0xc0c], eax
mov cl, byte [esi + 4]
mov byte [edi + 0xc10], cl
lea edi, [ebp - 0xc]
lea edx, [ebp - 0x10]
push edx
push 0x40
push 5
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
call ebx
test eax, eax
je 0x417b85
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x417b78
mov eax, dword [edi]
mov dword [esi], eax
mov cl, byte [edi + 4]
mov byte [esi + 4], cl
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x10]
push edx
push eax
push 5
push esi
call ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4

Function at 0x417c00
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0x417bd0
push 0
push 0
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x417c69
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x417c60
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417c78
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
mov ecx, edi
call fcn.00417430
mov ecx, dword [edi + 0xc04]
xor eax, eax
test ecx, ecx
je 0x417c91
mov edx, dword [edi + 0xc08]
push edx
push ebx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x417db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0xc04], ebx
mov dword [esi + 0xc08], ebx
mov byte [esi + 0xc0c], bl
push 0x417ca0
mov byte [esi], bl
mov byte [esi + 0x400], bl
mov byte [esi + 0x800], bl
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi + 0xc00], eax
push ebx
mov ecx, esi
mov dword [0x443194], esi
call fcn.00417ad0
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0041b530
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edx, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x10c]
call fcn.0040de70
push str.Real
lea ecx, [ebp - 0x10c]
call fcn.00417d20
call fcn.0041b0e0
push eax
lea ecx, [ebp - 0x10c]
call fcn.00417d20
lea ecx, [ebp - 0x10c]
call fcn.00417cc0
mov edi, dword [ebp - 0x10c]
cmp edi, ebx
je 0x417e90
push 0x400
push edi
push esi
call fcn.00415cd0
add esp, 0xc
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417eac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret

Function at 0x418590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
mov esi, ecx
call fcn.00410900
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esi + 8], ecx
push edx
lea ecx, [esi + 0xc]
call fcn.00410900
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [esi + 0x14]
call fcn.00410900
mov dx, word [ebp + 0x1c]
mov cx, word [ebp + 0x18]
mov eax, dword [ebp + 0x20]
mov word [esi + 0x1e], dx
mov word [esi + 0x1c], cx
xor ebx, ebx
mov dword [esi + 0x2c], eax
xor eax, eax
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
mov word [ebp - 0x14], cx
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
call fcn.00412f30
add esp, 4
cmp dword [ebp - 0xc], 8
jne 0x41865d
cmp word [ebp - 0x14], 4
jbe 0x41865d
mov cl, byte [esi + 7]
cmp cl, 0xff
je 0x418667
xor eax, eax
cmp cl, 7
sete al
cmp al, bl
jne 0x41865d
mov ecx, esi
call fcn.004182c0
test al, al
je 0x41865d
mov ecx, esi
call fcn.004182a0
test al, al
je 0x41865d
mov ecx, esi
call fcn.00418150
lea eax, [ebp + 0x18]
push eax
push ebx
push esi
push 0x418510
push ebx
push ebx
mov dword [ebp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp byte [esi + 4], bl
jne 0x418627
cmp byte [esi + 5], bl
jne 0x418627
cmp byte [esi + 6], bl
je 0x41865d
jmp 0x418627
Function at 0x4186f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 4], edi
je 0x418773
push 0x3ff
lea eax, [ebp - 0x403]
push edi
push eax
mov dword [ebp - 0x408], edi
mov byte [ebp - 0x404], 0
call fcn.0041b530
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.00420836
add esp, 0x18
test eax, eax
jle 0x418773
push edi
lea ecx, [ebp - 0x408]
push ecx
push eax
mov eax, dword [esi + 4]
lea edx, [ebp - 0x404]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret

Function at 0x418bf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x418c29
pop edi
mov esp, ebp
pop ebp
ret 0x14
push esi
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x418cac
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x418cac
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push ebx
sub edi, esi
xor ebx, ebx
mov dword [ebp + 8], eax
test eax, eax
jbe 0x418c86
lea eax, [ecx + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax - 8]
mov esi, dword [eax - 4]
cmp ecx, edx
ja 0x418c73
mov ecx, edx
cmp edi, esi
jb 0x418c7d
add ecx, esi
cmp edi, ecx
jbe 0x418c91
inc ebx
add eax, 0x28
cmp ebx, dword [ebp + 8]
jb 0x418c65
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
inc ebx
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 0x14
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x14