joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x70d89f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x72a348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x72a348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x729178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70d8a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x405afa
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dc5
test bl, 8
mov dword [ebp - 8], eax
je 0x405b39
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a2e8], eax
jmp 0x405cb6
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b53
test eax, eax
je 0x405c64
test bl, 2
je 0x405c64
mov esi, 0x425730
push edi
push esi
call fcn.004063e8
cmp dword [ebp + 8], 0
je 0x405b72
push 0x40a57c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405b78
push edi
call fcn.00405d09
cmp word [edi], 0
jne 0x405b88
cmp word [0x425730], 0x5c
jne 0x405b93
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c59
cmp word [ebp - 0x22c], 0x2e
jne 0x405bdd
cmp word [ebp - 0x22a], 0
je 0x405c3c
cmp word [ebp - 0x22a], 0x2e
jne 0x405bdd
cmp word [ebp - 0x228], 0
je 0x405c3c
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004063e8
test byte [ebp - 0x258], 0x10
je 0x405c08
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c3c
push dword [ebp + 0xc]
push edi
call fcn.00405afa
jmp 0x405c3c
push dword [ebp - 4]
push edi
call fcn.00405ab2
test eax, eax
jne 0x405c34
cmp dword [ebp - 4], eax
je 0x405c2c
push edi
push 0xfffffffffffffff1
call fcn.00405450
push 0
push edi
call fcn.004061ae
jmp 0x405c3c
inc dword [0x42a2e8]
jmp 0x405c3c
push edi
push 0xfffffffffffffff2
call fcn.00405450
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bb5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c64
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cb6
cmp dword [ebp - 8], esi
jne 0x405c78
inc dword [0x42a2e8]
jmp 0x405cb6
push edi
call fcn.0040672b
test eax, eax
je 0x405cb6
push edi
call fcn.00405cbd
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405ab2
test eax, eax
jne 0x405cae
cmp dword [ebp - 4], esi
je 0x405c70
push edi
push 0xfffffffffffffff1
call fcn.00405450
push esi
push edi
call fcn.004061ae
jmp 0x405cb6
push edi
push 0xffffffffffffffe5
call fcn.00405450
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x10001018
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10001043
push section..data
push 0
push 0
push 0x10001078
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, 1
leave
ret 0xc
cmp dword [ebp + 0xc], 0
jne 0x10001054
mov eax, 1
leave
ret 0xc
cmp dword [ebp + 0xc], 2
jne 0x10001065
mov eax, 1
leave
ret 0xc
cmp dword [ebp + 0xc], 3
jne 0x10001074
mov eax, 1
leave
ret 0xc
leave
ret 0xc
Function at 0x401db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401dc7
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401dfc
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp loc.004d12d8
xor eax, eax
jmp 0x401e09
pop edi
pop esi
ret
Function at 0x40ecf0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esi + 0x40]
push ebx
push ebp
push edi
mov edi, 0xffff
xor al, al
mov bl, 1
cmp ecx, edi
je 0x40ee8a
mov ebp, 0x10000000
cmp ecx, 0x7c
je 0x40ee8a
cmp ecx, 0x29
jne 0x40ed36
cmp dword [esi + 0x10], 0
jne 0x40ee8a
test dword [esi + 0x44], ebp
jne 0x40ed36
push 5
call fcn.0042dced
pop ecx
jmp 0x40ee74
cmp ecx, 0x2e
jne 0x40ed52
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0040ef6d
mov eax, esi
call fcn.0040ecc4
jmp 0x40ee74
cmp ecx, 0x5c
jne 0x40edb3
mov eax, esi
call fcn.0040ecc4
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x40ed86
cmp word [esi + 0x3e], 0x62
jne 0x40ed86
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0040ef6d
mov eax, esi
call fcn.0040ecc4
jmp 0x40ee7b
test eax, eax
je 0x40eda7
cmp word [esi + 0x3e], 0x42
jne 0x40eda7
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0040ef6d
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x40ed7a
mov eax, esi
call fcn.0040f72d
jmp 0x40ee74
cmp ecx, 0x5b
jne 0x40eddd
mov eax, esi
call fcn.0040ecc4
mov eax, esi
call fcn.0040f6e2
cmp dword [esi + 0x40], 0x5d
je 0x40ed46
push 4
call fcn.0042dced
pop ecx
jmp 0x40ed46
cmp ecx, 0x28
jne 0x40ee09
mov eax, esi
call fcn.0040ecc4
mov eax, esi
call fcn.0040f7ff
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x40ee00
push 5
call fcn.0042dced
pop ecx
mov eax, esi
call fcn.0040ecc4
jmp 0x40ee70
cmp ecx, 0x5e
jne 0x40ee15
push 2
jmp 0x40ed71
cmp ecx, 0x24
jne 0x40ee21
push 3
jmp 0x40ed71
cmp ecx, 0x2a
je 0x40ee68
cmp ecx, 0x2b
je 0x40ee68
cmp ecx, 0x3f
je 0x40ee68
cmp ecx, 0x7b
je 0x40ee68
cmp ecx, 0x7d
jne 0x40ee46
test dword [esi + 0x44], ebp
jne 0x40ee46
push 6
jmp 0x40ed2b
cmp ecx, 0x5d
jne 0x40ee57
test dword [esi + 0x44], ebp
jne 0x40ee57
push 4
jmp 0x40ed2b
mov ax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
call fcn.0040f995
jmp 0x40ed46
push 0xa
call fcn.0042dced
pop ecx
test bl, bl
je 0x40ee7b
mov eax, esi
call fcn.0040f8cd
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, edi
jne 0x40ed0c
pop edi
pop ebp
pop ebx
ret

Function at 0x410c11
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x424
mov eax, 0x433f83
call fcn.0042e78d
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.0041ca10
add esp, 0xc
mov esi, 0x103
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
je 0x410d43
jmp loc.004d2ef8
call fcn.0042e810
ret
Function at 0x410d49
Capabilities:
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4339dc
mov eax, dword fs:[0]
push eax
mov eax, 0x20f0
call fcn.004263c0
mov eax, dword [0x442080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20b4], eax
xor eax, eax
mov edi, 0x1048
push edi
mov word [ebp - 0x1060], ax
xor esi, esi
lea eax, [ebp - 0x105e]
push esi
push eax
mov ebx, ecx
call fcn.0041ca10
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x20b0], ax
lea eax, [ebp - 0x20ae]
push esi
push eax
call fcn.0041ca10
add esp, 0xc
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x20fc]
push esi
push eax
call fcn.0041ca10
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x20ec], eax
mov eax, 0x824
lea ecx, [ebp - 0x20b0]
mov dword [ebp - 0x20e8], eax
mov dword [ebp - 0x20cc], eax
mov eax, ebx
mov dword [ebp - 0x20d0], ecx
add esp, 0xc
mov dword [ebp - 0x20fc], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x410e09
sub eax, ecx
lea ecx, [ebp - 0x20fc]
push ecx
push esi
sar eax, 1
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x410f2b
push esi
push esi
push esi
push esi
push dword [ebp - 0x20b4]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x20b8], eax
cmp eax, esi
je 0x410f2b
push esi
push esi
push 3
push esi
push esi
push dword [ebp - 0x20e4]
lea ecx, [ebp - 0x1060]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebp - 0x20b4], eax
cmp eax, esi
je 0x410f1f
xor ebx, ebx
mov eax, 0x1bb
cmp word [ebp - 0x20e4], ax
push esi
setne bl
lea eax, [ebp - 0x20bc]
push 0x439ee0
push eax
dec ebx
and ebx, 0x800000
or ebx, 0x8440f300
call fcn.00413ad1
add esp, 0xc
mov edi, eax
push esi
lea eax, [ebp - 0x20c0]
push 0x439efc
push eax
mov dword [ebp - 4], esi
call fcn.00413ad1
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0xc
push esi
push ebx
push esi
push esi
push edi
lea ecx, [ebp - 0x20b0]
push ecx
push eax
push dword [ebp - 0x20b4]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
mov eax, dword [ebp - 0x20c0]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x20bc]
add eax, 0xfffffff0
call fcn.00401053
cmp edi, esi
je 0x410f13
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x20b4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp loc.004d3dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a944
leave
ret
Function at 0x41175e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x43396c
call fcn.0042e724
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, dword [0x44970c]
mov ecx, 0x44970c
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
je 0x4117be
jmp 0x4d3470
push dword [ebp + 8]
call fcn.00404084
lea eax, [ebx - 0x10]
call fcn.00401053
mov eax, dword [ebp + 8]
jmp 0x41184e
cmp dword [ebp - 0x18], 1
je 0x4117ca
cmp dword [ebp - 0x18], 2
jne 0x4117a1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b18b
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x4117a1
push dword [ebp - 0x14]
push edi
push eax
call fcn.0041ca10
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push dword [ebp - 0x10]
test eax, eax
je 0x41181e
call fcn.0041a939
mov dword [esp], 0x438a10
jmp 0x4117a6
lea eax, [ebp - 0x1c]
push eax
call fcn.00401aa8
push dword [ebp - 0x10]
call fcn.0041a939
mov esi, dword [ebp - 0x1c]
add esi, 0xfffffff0
pop ecx
mov eax, esi
call fcn.0040482d
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.00401053
mov eax, edi
call fcn.0042e7fc
ret 0xc

Function at 0x411856
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x433949
call fcn.0042e724
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41191d
cmp dword [ebp - 0x14], 7
jne 0x41191d
mov edi, dword [ebp - 0x10]
shr edi, 1
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b18b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41191d
push dword [ebp - 0x10]
push 0
push ebx
call fcn.0041ca10
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x411916
xor esi, esi
test edi, edi
jle 0x411916
lea eax, [ebx + esi*2]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00404084
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x4118ff
push eax
push dword [ebp + 0x10]
call fcn.00412fe4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
or dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lea esi, [esi + ecx + 1]
call fcn.00401053
cmp esi, edi
jl 0x4118d9
push ebx
call fcn.0041a939
pop ecx
call fcn.0042e7fc
ret 0xc
Function at 0x412785
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x433cf3
call fcn.0042e724
mov esi, ecx
xor edi, edi
push edi
lea eax, [ebp - 0x14]
push 0x439fb8
push eax
mov dword [ebp - 0x10], edi
call fcn.00413ad1
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [ebp - 0x14]
setne bl
add eax, 0xfffffff0
call fcn.00401053
test bl, bl
je 0x4127de
xor eax, eax
inc eax
jmp 0x412868
push edi
lea eax, [ebp - 0x14]
push 0x43a044
push eax
call fcn.00413ad1
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [esi]
mov ecx, dword [ecx - 0xc]
mov ebx, dword [eax]
lea eax, [ecx + ecx + 2]
push eax
call fcn.00404273
push eax
xor esi, esi
inc esi
push esi
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
inc bl
add eax, 0xfffffff0
and bl, 1
call fcn.00401053
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x18]
push 0x43a2a0
push eax
call fcn.00413ad1
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [eax]
call fcn.00412e88
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401053
xor eax, eax
test bl, bl
sete al
call fcn.0042e7fc
ret 4

Function at 0x412b3a
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x433926
call fcn.0042e724
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x20], edi
mov eax, dword [esi + 0x44]
cmp eax, edi
jbe 0x412b59
mov eax, dword [esi + 0x40]
jmp 0x412b71
push 0x438a10
lea eax, [ebp - 0x28]
push eax
call fcn.00404084
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], 1
mov eax, dword [eax]
sub eax, 0x10
call fcn.0040482d
lea ebx, [eax + 0x10]
mov dword [ebp - 0x30], ebx
jmp 0x4d2728
Function at 0x41a7ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x449788], 0
push esi
jne 0x41a772
call fcn.0041a698
test eax, eax
je 0x41a7b5
mov eax, dword [0x449788]
cmp eax, 1
jne 0x41a793
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41a7b5
pop esi
ret
push eax
call dword [0x449790]
test eax, eax
jne 0x41a7fd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41a7b9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x449788]
call dword [0x449790]
mov edi, eax
test edi, edi
je 0x41a7de
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41a7fa
mov edi, esi
add esi, 0xff0
push edi
jmp 0x4d1aa8
mov eax, edi
pop edi
pop esi
ret
jmp 0x41a75f

Function at 0x41a944
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442080]
jne 0x41a94e
repz ret
jmp fcn.0041cc7c

Function at 0x425d20
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x425d36
xor eax, eax
pop ebp
ret
jmp loc.004ca3e8
Function at 0x100011c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100c2004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push 0xffffffffffffffff
push 0x401
push eax
call fcn.10001280
push dword [eax + 4]
push dword [eax]
call fcn.100337fb
or ecx, 0xffffffff
add esp, 0x20
test eax, eax
cmovs eax, ecx
mov ecx, 0x400
cmp eax, 0xffffffff
cmove eax, ecx
nop
sub eax, 1
lea ecx, [eax + eax]
js 0x10001223
cmp word [ebp + ecx - 0x808], 0xa
je 0x10001210
cmp word [ebp + ecx - 0x806], 0xa
jne 0x10001251
cmp word [ebp + ecx - 0x804], 0xa
jne 0x10001251
lea eax, [eax*2 + 4]
cmp eax, 0x802
jae 0x1000126c
xor ecx, ecx
mov word [ebp + eax - 0x808], cx
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret
call fcn.1002dc7b
int3

Function at 0x10002030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0xc]
sub esp, 0x38
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002045
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10002079
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push eax
lea ecx, [esp + 0xc]
call fcn.10001290
push 0x100c015c
lea eax, [esp + 0xc]
push eax
call fcn.1002f43a
int3

Function at 0x100023e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10002403
cmp eax, 2
je 0x10002403
cmp eax, 3
jne 0x10002409
mov esp, ebp
pop ebp
ret 4
push eax
lea ecx, [esp + 4]
call fcn.10001290
push 0x100c015c
lea eax, [esp + 4]
push eax
call fcn.1002f43a
int3
Function at 0x100024f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040ccd
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x100c2004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], eax
xor eax, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x100025fc
cmp eax, 3
je 0x100025fc
test eax, eax
jne 0x1000262a
mov eax, dword [ebp - 0x14]
inc eax
push ecx
shr eax, 1
lea ecx, [ebp - 0x30]
push eax
call fcn.10005120
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
add eax, eax
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x10002546
cmp eax, 2
je 0x100025fc
cmp eax, 3
je 0x100025fc
test eax, eax
jne 0x1000262a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x58]
call fcn.10004c10
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x34]
push eax
call fcn.100043e0
lea ecx, [ebp - 0x58]
call fcn.10002650
lea ecx, [ebp - 0x30]
call fcn.10002650
mov eax, dword [ebp - 0x34]
jmp 0x1000260d
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
mov byte [esi + 0x20], 0
call fcn.10002650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 8
push eax
lea ecx, [ebp - 0x70]
call fcn.10001290
push 0x100c015c
lea eax, [ebp - 0x70]
push eax
call fcn.1002f43a
int3