joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a835
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.100220b2
add esp, 0xc
jge 0x1003a850
jae 0x1003a870
pushf
cmp eax, esi
ja 0x1003a858
xor ecx, 0x83c
xor ecx, 0x83c
mov esi, esi
popf
xchg esp, esp
nop
xchg esp, esp
jb 0x1003a870
lcall 0x45c6, 0x53f445c6
cmc
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
je 0x1003a8a2
mov edi, edi
lea eax, [eax]
jge 0x1003a8b2
ja 0x1003a8aa
jnp 0x1003a8ac
xchg esp, esp
jl 0x1003a8b2
mov esp, 0xf44d8a99
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
rol edx, 0
lea esi, [esi]
lea edi, [edi + 0x4b00]
sub edi, 0x4b00
jno 0x1003a936
pushf
sub edx, 0
or esp, 0
popf
jbe 0x1003a931
jae 0x1003a933
jo 0x1003a936
sub eax, 0xff3ea7e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call fcn.1002e7e2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1003a94e
mov eax, 1
jmp 0x1003a9fe
test dword [esp + 0x10], eax
or edi, edi
nop
push ecx
pop ecx
jg 0x1003a979
pushf
not ebx
not ebx
or edx, 0
cmp edx, dword [esp]
popf
lea edi, [edi + 0x722a]
lea edi, [edi - 0x722a]
nop
mov eax, eax
jle 0x1003a979
mov esi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10043d83
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.100220b2
add esp, 0xc
mov ebx, ebx
ror eax, 0x16
ror eax, 0xa
std
cld
xor esp, 0
jge 0x1003a9c4
pushf
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
jp 0x1003a9b4
and esi, esi
ror esp, 0
popf
jnp 0x1003a9bd
nop
lea esp, [esp]
jl 0x1003a9c4
mov eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x1003a9d1
mov eax, 1
jmp 0x1003a9fe
clc
and eax, eax
jae 0x1003a9dd
lea edx, [edx]
jae 0x1003a9da
jb 0x1003a9dd
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.1003f812
add esp, 4
shl esp, 0
jno 0x1003a9f7
jl 0x1003a9f0
xchg edi, edi
jb 0x1003a9f4
jo 0x1003a9f7
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b90e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.100220b2
add esp, 0xc
clc
jbe 0x1003b94c
pushf
and edi, edi
ror edx, 7
rol edx, 7
shr edi, 0
jae 0x1003b939
popf
lea eax, [eax + 0x5ac7]
lea eax, [eax - 0x5ac7]
jg 0x1003b949
ja 0x1003b94c
mov esp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
or ecx, ecx
je 0x1003b9a6
pushf
jmp 0x1003b99c
xor esp, 0
popf
jle 0x1003b9a3
jne 0x1003b9a6
mov esi, 0x80e44d8a
jmp 0xf45141b0
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.10024b86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1003ba54
xor eax, eax
jmp 0x1003bacb
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10043d83
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1003bac9
xor esp, 0
xchg edx, esi
xchg edx, esi
cmp ebx, dword [esp + 8]
jno 0x1003ba90
mov esi, esi
xchg esp, esp
jo 0x1003ba90
call 0x5d8f9847
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003f812
add esp, 4
and ecx, ecx
inc edi
dec edi
ja 0x1003baa2
jmp 0x1003baa4
jl 0x1003bab0
jo 0x1003baa8
jg 0x1003baaa
je 0x1003baac
jge 0x1003bab0
jmp 0x28594692
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1003bacb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1003dc6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
rol ebx, 3
ror ebx, 3
jns 0x1003dca1
ja 0x1003dc95
xchg edi, esi
xchg edi, esi
mov esp, esp
jnp 0x1003dc9d
js 0x1003dca1
mov ebp, 0xec45c6fa
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.10024b86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003dd69
xor eax, eax
jmp 0x1003ddd2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10043d83
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x1003dd93
xor eax, eax
jmp 0x1003ddd2
and esp, 0xffffffff
shr ebx, 0
xchg esp, esp
jp 0x1003dda5
jno 0x1003dd9f
jbe 0x1003dda1
jnp 0x1003dda5
mov esi, 0xe8458bd0
mov eax, dword [ebp - 0x18]
push eax
call fcn.1003f812
add esp, 4
cmp ebx, 0x4426
ror esp, 0
jge 0x1003ddc7
js 0x1003ddbe
mov esp, esp
je 0x1003ddc2
jp 0x1003ddc4
jl 0x1003ddc7
call 0x61102b56
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003f0c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.100220b2
add esp, 0xc
js 0x1003f0e0
jbe 0x1003f0ed
jns 0x1003f0e4
jae 0x1003f0e6
xchg ebx, edi
xchg ebx, edi
ja 0x1003f0ed
mov edx, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
add ebx, 0x49e3
sub ebx, 0x49e3
call fcn.1003f14a
Function at 0x10043429
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.100220b2
add esp, 0xc
push 0x21
push 0x10015bc0
lea ecx, [ebp - 0x138]
push ecx
call fcn.100266dd
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10043531
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.100220b2
add esp, 0xc
push 0xb
push 0x10015be4
lea edx, [ebp - 0x138]
push edx
call fcn.100266dd
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10043524
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100266dd
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10043533
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100441ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100220b2
add esp, 0xc
nop
shl esp, 0
jg 0x10044217
jge 0x1004420f
jb 0x10044211
jo 0x10044213
jle 0x10044217
call 0xfc4a0891
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
jbe 0x10044251
ror eax, 0
rol edx, 3
rol edx, 0x1d
jg 0x1004425c
je 0x10044269
jb 0x10044260
jns 0x10044262
jg 0x10044264
jne 0x10044269
mov esp, 0x4d8abe34
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.10041083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100442ec
xor eax, eax
jmp 0x1004435b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.10043d83
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x10044359
push esi
add esi, 0x2ee5
ror esi, 0x19
pop esi
ja 0x1004432a
jmp 0x10044321
lea eax, [eax]
xchg ebx, ebx
jl 0x10044327
jbe 0x1004432a
mov esi, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.1003f812
add esp, 4
ror eax, 0x15
ror eax, 0xb
jp 0x1004433e
js 0x10044340
jnp 0x10044348
mov esp, esp
jp 0x10044348
mov edx, 0x10458b8f
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x1004435b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c2d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1012288]
mov dword [ebp - 4], eax
mov eax, dword [0x1011030]
test byte [eax + 0x14f9], 1
push ebx
mov ebx, ecx
je 0x100c31a
add eax, 0x6aa
push eax
push 0x30c
add ebx, 0x54
push ebx
push 0x1002a0c
push 0x10029c8
push 0x1001f94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x100c38d
and dword [ebp - 0x20c], 0
push esi
push edi
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001b64
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x10022b8
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x30c
add ebx, 0x54
push ebx
push 0x1002a0c
push 0x10029c8
push 0x1002294
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100ecf8
leave
ret

Function at 0x100c3c4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
je 0x100c415
push ebx
push edi
push dword [esi + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ebx, [esi + 0x44]
push dword [ebx]
call edi
push ebx
push esi
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
add esi, 0x54
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop ebx
jmp 0x100c425
push 0
push 0x100c39d
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
pop esi
leave
ret

Function at 0x100eecd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002b68
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ef25
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x100215a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ef18
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100ef27
xor eax, eax
pop esi
leave
ret 4

Function at 0x401034
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x401cf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x462108
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x47d744]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x104
call fcn.0041debf
push 0x104
mov edi, eax
push 0
push edi
call fcn.00446d10
mov eax, dword [esp + 0x4c]
add esp, 0x10
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00415cd0
lea esi, [esp + 0x3c]
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00415f10
mov edx, dword [eax]
push edx
push 0x46a95c
push edi
call fcn.00443c20
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x38]
add ebx, 4
mov edx, ebx
mov ecx, edi
call fcn.0040b900
push edi
call fcn.0041deca
add esp, 4
call fcn.0040b340
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x401dbf
push 0x46a990
push eax
call fcn.00443eea
add esp, 8
test eax, eax
jne 0x401dc4
or eax, 0xffffffff
jmp 0x401dc6
sub eax, dword [ebx]
push ebx
xor ecx, ecx
call fcn.00402b50
lea ecx, [esp + 0x10]
call fcn.00415c40
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x40d7b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4604f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x47d744]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.00433bd5
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], 0
mov eax, dword [eax + 4]
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00433c6c
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00433bfd
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40dc40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], ebx
cmp eax, ebx
je 0x40dc65
push ebx
push eax
mov eax, dword [esi + 4]
push eax
call fcn.00445214
add esp, 0xc
mov ecx, dword [esi + 4]
push ecx
call fcn.00445724
add esp, 4
cmp al, 1
je 0x40dc98
cmp al, 2
je 0x40dc98
mov edx, dword [esi + 4]
push 1
push 0xffffffffffffffff
push edx
call fcn.00445214
add esp, 0xc
push ebx
push edi
call fcn.0040db20
mov eax, edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push eax
push 3
lea ecx, [esp + 0x14]
push 1
push ecx
mov dword [esp + 0x1c], ebx
call fcn.00445539
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp eax, ebx
je 0x40dcc8
push eax
push edi
call fcn.0040db20
mov eax, edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push 0x46c590
mov ecx, edi
mov byte [edi + 4], bl
call fcn.0040a440
pop esi
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f0c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4604cb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47d744]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x46a874
call fcn.0045dd86
push 4
mov dword [esp + 0x24], 0
call fcn.0041de90
mov edi, eax
add esp, 4
test edi, edi
je 0x40f142
call fcn.0045e0d1
mov dword [edi], eax
call fcn.0045deff
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0045de23
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40f137
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0045de4b
jmp 0x40f144
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x415cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4617a4
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47d744]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
lea edi, [esi + 4]
push eax
mov ecx, edi
mov dword [esi], 0x46d610
call fcn.00403460
lea ecx, [esi + 8]
push 0x46b93f
mov dword [esp + 0x28], 0
call fcn.00403460
lea ebp, [esi + 0xc]
push 0x46b93f
mov ecx, ebp
mov byte [esp + 0x28], 1
call fcn.00403460
lea ebx, [esi + 0x10]
push 0x46b93f
mov ecx, ebx
mov byte [esp + 0x28], 2
call fcn.00403460
mov byte [esp + 0x24], 3
mov ecx, dword [edi]
mov dword [esi + 0x14], 0x50
cmp dword [ecx - 0xc], 0
je 0x415e12
lea edx, [esp + 0x30]
push edx
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00415e30
push 0x46d5e4
lea ecx, [esp + 0x18]
call fcn.00403460
mov byte [esp + 0x24], 4
cmp dword [esp + 0x18], 0x100b
jne 0x415da5
push 8
push 0x46d5ec
lea ecx, [esp + 0x1c]
call fcn.00403700
mov cx, word [esp + 0x30]
mov edx, dword [ebp]
movzx eax, cx
cmp cx, 0x50
mov ecx, dword [ebx]
mov dword [esi + 0x14], eax
push ecx
jne 0x415dd5
mov eax, dword [esp + 0x18]
push edx
push eax
lea eax, [esi + 8]
push 0x46d5f8
push eax
call fcn.00404580
add esp, 0x14
jmp 0x415ded
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
lea eax, [esi + 8]
push 0x46d600
push eax
call fcn.00404580
add esp, 0x18
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415e12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8