joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x528ef3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x589758]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.004a6916
xor ecx, ecx
lea ebp, [esi + 0x10]
mov dword [esi], vtable.CMemDC.0
mov dword [esp + 0x28], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], vtable.CBitmap.0
mov ebx, dword [esp + 0x30]
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xc], ecx
mov byte [esp + 0x28], 1
sete al
mov dword [esi + 0x30], eax
cmp eax, ecx
je 0x405080
mov eax, dword [ebx]
mov edx, dword [eax + 0x50]
lea edi, [esi + 0x20]
push edi
mov ecx, ebx
call edx
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.004a705c
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
push eax
mov eax, dword [ebx + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebp
call fcn.004a732e
test ebp, ebp
je 0x40505e
mov ebp, dword [ebp + 4]
mov ecx, dword [esi + 4]
push ebp
push ecx
call fcn.004a73f2
mov edx, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.004a6ab6
jmp 0x405092
mov edx, dword [ebx + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x405580
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x528fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x589758]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], vtable.CPen.0
mov ecx, dword [esp + 0x40]
push ecx
push 1
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x10]
call fcn.004a732e
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004a744e
mov ecx, dword [esp + 0x30]
mov edi, eax
mov eax, dword [esp + 0x34]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.004a6c03
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, esi
call fcn.004a653c
push edi
mov ecx, esi
call fcn.004a744e
lea ecx, [esp + 0xc]
call fcn.004a7386
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.CPen.0
call fcn.00404e40
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0x18
Function at 0x408130
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x529368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x589758]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], vtable.CPen.0
mov ecx, dword [esp + 0x40]
push ecx
push 1
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x10]
call fcn.004a732e
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004a744e
mov ecx, dword [esp + 0x30]
mov edi, eax
mov eax, dword [esp + 0x34]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.004a6c03
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, esi
call fcn.004a653c
push edi
mov ecx, esi
call fcn.004a744e
lea ecx, [esp + 0xc]
call fcn.004a7386
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.CPen.0
call fcn.00404e40
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0x18
Function at 0x40b850
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x529748
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x589758]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
push 0
push 1
mov dword [esi + 0x130], edi
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0
push 0x843
call fcn.0049eea6
push eax
lea ecx, [esp + 0x30]
call fcn.00402f70
mov dword [esp + 0x18], 0
test edi, edi
je 0x40b8bf
mov edi, dword [edi + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
push 0
push 0
push edi
push 0x64
push 0x64
push eax
push ecx
push 0x90000000
push 0x539408
push edx
push 0
mov ecx, esi
call fcn.0049e05a
test eax, eax
jne 0x40b92d
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b916
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x18
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40b93e
push eax
lea ecx, [esi + 0x74]
call fcn.00402ef0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40b94f
push eax
lea ecx, [esi + 0x70]
call fcn.00402ef0
mov ecx, esi
call fcn.0040a7b0
mov ecx, esi
call fcn.0040aa60
push ebx
mov ecx, esi
call fcn.0040a680
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0049bbfd
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b99d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x18
Function at 0x40fb80
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push edi
mov edi, dword [esp + 0x20]
push 0
push 0x200
push ebx
push edi
mov dword [esp + 0x1c], 0
call fcn.004f83b0
or eax, edx
jne 0x40fc88
mov ebp, dword [esp + 0x1c]
test ebp, 0x1ff
jne 0x40fc88
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
cmp byte [esi + 0x30], al
je 0x40fc29
cmp byte [esi + 0x31], al
jne 0x40fc01
mov ecx, dword [esi + 4]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x20]
push ebp
push ecx
push edx
push ebx
push edi
push eax
call fcn.0040f4f0
add esp, 0x20
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp byte [esi + 0x31], 0
jne 0x40fc60
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0x2c]
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x20]
push ebp
push edx
push eax
push ebx
push edi
push ecx
call fcn.0040f4f0
add esp, 0x20
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x413cb0
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00498626
mov ecx, esi
call fcn.004133d0
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x110a
push eax
call ebp
mov eax, dword [esi + 0x334]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00402350
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.004110f0
mov edi, eax
mov ecx, esi
test edi, edi
jne 0x413d11
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.0049863b
push edi
call fcn.0040fec0
push edi
mov ecx, esi
call fcn.00412740
push edi
mov ecx, esi
test eax, eax
jne 0x413d7b
call fcn.0040fe10
push 0xffff0002
push edi
push 0
push 0
push 0
push 0
push 0
push 0x53b76c
push 1
mov ecx, esi
call fcn.004a2b5f
mov ecx, dword [esi + 0x20]
push edi
push 1
push 0x1102
push ecx
call ebp
push 0
push 0x40
push 0
push 0
push 0
push 0
push 8
push edi
mov ecx, esi
call fcn.004a2aad
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.0049863b
lea edx, [esp + 0x14]
push edx
call fcn.004a4903
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413db4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
mov ecx, esi
test bl, bl
jne 0x413d26
call fcn.0040fd90
cmp dword [esi + 0x3ac], 0
je 0x413dd5
push edi
mov ecx, esi
call fcn.00412460
push edi
mov ecx, esi
call fcn.00413130
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.0049863b
Function at 0x41a390
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor ebx, ebx
mov esi, ecx
sub ecx, ebp
mov dword [esp + 0xc], ebx
mov eax, ebp
lea edx, [ecx + 8]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41a3a7
mov ecx, esi
call fcn.00419f60
cmp dword [esi + 0x120], ebx
jne 0x41a3c9
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [esi + 0x11c], eax
cmp eax, ebx
jne 0x41a491
push ebp
mov ecx, esi
call fcn.0041a000
test eax, eax
jne 0x41a411
mov eax, dword [esi + 0x11c]
cmp eax, ebx
je 0x41a407
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x11c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
push 0x1028
call fcn.00496d83
add esp, 4
cmp eax, ebx
je 0x41a43c
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 0x114]
push ecx
push edx
mov ecx, eax
call fcn.00419e10
jmp 0x41a43e
xor eax, eax
mov ecx, dword [esi + 0x114]
push ebx
push eax
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x11c]
push eax
push ecx
call edi
mov dword [esi + 0x11c], eax
cmp eax, 0xffffffff
jne 0x41a49b
mov eax, dword [esi + 0x124]
cmp eax, ebx
je 0x41a47a
push eax
call fcn.00496db2
add esp, 4
mov dword [esi + 0x124], ebx
mov eax, dword [esi + 0x114]
cmp eax, ebx
je 0x41a491
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x114], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push ebx
push esi
push 0x41a370
push ebx
push ebx
call fcn.004f88fc
mov ecx, dword [esi + 0x124]
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x11c]
add esp, 0x18
push eax
call fcn.00419e80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0xc

Function at 0x421f60
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x421f70
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret

Function at 0x422510
Capabilities:
Create service

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push 0
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x24]
push 1
push 1
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x422553
test esi, esi
jne 0x422553
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop esi
ret
Function at 0x422670
Capabilities:
Stop service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x1c
push esi
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x422694
pop esi
add esp, 0x1c
ret
push edi
lea edx, [esp + 8]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x422a10
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x422a37
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x422a5e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x422aab
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call ebx
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
pop ebx
cmp eax, 0x420
je 0x422ab7
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x422aa3
cmp dword [esp + 0xc], 4
je 0x422ab7
call edi
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret

Function at 0x422b60
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x422b7e
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x422ba5
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x422bd2
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret
Function at 0x424870
Capabilities:
Get common file path

Disassembly:
push esi
call fcn.00424490
mov esi, dword [esp + 8]
test eax, eax
je 0x4248b6
mov eax, dword [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, esi
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424890
mov ecx, dword [str.SysWOW64]
mov dword [eax], ecx
mov edx, dword [0x53ecc4]
mov dword [eax + 4], edx
mov cx, word [0x53ecc8]
mov word [eax + 8], cx
jmp 0x4248c2
mov edx, dword [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, esi
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4248c8
sub eax, edx
ret

Function at 0x424b10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SoftwareJstar
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424b5d
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareJstar
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x424b9e
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424b67
mov ecx, dword [esp + 4]
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 8
ret

Function at 0x424bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SoftwareJstar
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424c11
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x424c17
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret

Function at 0x424c30
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SoftwareJstar
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424c54
xor eax, eax
pop ecx
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
Function at 0x424ff0
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
lea ecx, [ebx + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esp + 0x14]
shr edx, 1
lea edx, [edx*4 + 1]
cmp dword [eax], edx
jae 0x425015
or eax, 0xffffffff
pop ebx
ret
mov ecx, dword [esp + 0x10]
mov eax, 0xaaaaaaab
mul ebx
push ebp
shr edx, 1
push esi
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
lea eax, [edx + edx*2]
xor ebp, ebp
push edi
test eax, eax
jbe 0x4250ab
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 1
inc edi
lea eax, [edi + edi*2]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov edi, edi
movzx edx, byte [eax]
shr edx, 2
movzx edx, byte [edx + esi]
mov byte [ecx], dl
movzx edx, byte [eax + 1]
movzx ebp, byte [eax]
shr edx, 4
shl ebp, 4
add edx, ebp
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 2]
movzx ebp, byte [eax + 1]
inc ecx
shr edx, 6
lea edx, [edx + ebp*4]
and edx, 0x3f
movzx edx, byte [edx + esi]
inc ecx
mov byte [ecx], dl
movzx edx, byte [eax + 2]
and edx, 0x3f
movzx edx, byte [edx + esi]
inc ecx
mov byte [ecx], dl
inc ecx
add eax, 3
sub edi, 1
jne 0x425050
mov ebp, dword [esp + 0x18]
jmp 0x4250af
mov eax, dword [esp + 0x14]
cmp ebp, ebx
jae 0x4250f9
movzx edx, byte [eax]
inc ebp
cmp ebp, ebx
jae 0x4250c1
movzx edi, byte [eax + 1]
jmp 0x4250c3
xor edi, edi
mov eax, edx
shr eax, 2
and eax, 0x3f
mov al, byte [eax + esi]
mov byte [ecx], al
mov eax, edi
shr eax, 4
shl edx, 4
add eax, edx
and eax, 0x3f
mov dl, byte [eax + esi]
inc ecx
mov byte [ecx], dl
inc ecx
cmp ebp, ebx
jae 0x4250f0
and edi, 0xf
mov al, byte [esi + edi*4]
jmp 0x4250f2
mov al, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [esp + 0x20]
pop edi
mov byte [ecx], 0
sub ecx, dword [esp + 0x18]
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
ret
Function at 0x4338f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push edi
mov edi, dword [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x433916
sub eax, edx
add eax, edi
je 0x433975
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
jmp 0x433930
push 0x5c
push eax
call fcn.004f8120
mov esi, eax
add esp, 8
test esi, esi
je 0x433973
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004f67e0
mov ecx, esi
sub ecx, edi
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.004f7b80
add esp, 0x18
push 0
lea eax, [esp + 0x10]
push eax
call ebx
lea eax, [esi + 1]
jmp 0x433930
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004f6592
add esp, 0x108
ret

Function at 0x434650
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x404
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x400
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 8]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x434680
mov ecx, dword [str.NSAR]
mov dl, byte [0x53f8ac]
mov dword [eax], ecx
mov byte [eax + 4], dl
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esp + 8]
dec edi
jmp 0x4346b0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4346b0
mov edx, dword [esp + 0x410]
mov cx, word [0x539558]
push edx
push 0
lea eax, [esp + 0x10]
mov word [edi], cx
push eax
mov ecx, esi
call fcn.004345a0
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004f6592
add esp, 0x404
ret 4
Function at 0x4348b0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x52bb5b
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
mov eax, dword [0x589758]
xor eax, esp
push eax
lea eax, [esp + 0x424]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.004ad3e4
lea eax, [esp + 0x20]
push eax
push 0x400
mov dword [esp + 0x434], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x20]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x434914
mov ecx, dword [str.NSTAR]
mov dx, word [0x53f8b4]
mov dword [eax], ecx
mov word [eax + 4], dx
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esp + 0x20]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x434941
mov cx, word [0x539558]
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
mov word [edi], cx
mov ecx, dword [esi + 0x38]
push eax
call fcn.004345a0
cmp dword [0x5bf1d8], 0
lea ecx, [esp + 0xc]
je 0x434988
mov dword [esp + 0x42c], 0xffffffff
call fcn.004ad74d
xor eax, eax
jmp 0x4349a8
push ecx
mov ecx, esi
call fcn.004347d0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x42c], 0xffffffff
call fcn.004ad74d
mov eax, esi
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004f6592
add esp, 0x424
ret