joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f7ec4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f806f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5f8050
mov dl, 1
mov eax, dword [0x441ec8]
call fcn.0046b944
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409d14
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5f803f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00550bc4
test al, al
je 0x5f8032
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5f8080
lea eax, [ebp - 0x394]
call fcn.00425234
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5f8032
xor eax, eax
push ebp
push 0x5f802b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5f80f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5f8014
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a850
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5f8014
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8032
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5f7f35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.0046b86c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8076
lea eax, [ebp - 0x3a0]
call fcn.00409d14
ret

Function at 0x5f8c7c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6237b0]
cmp byte [eax + 0xc5], 0
jne 0x5f8cee
cmp dword [0x6237d4], 0
jne 0x5f8cae
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x61bb1c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6237d4], eax
cmp dword [0x6237d0], 0
jne 0x5f8cc9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x6237d0], eax
cmp dword [0x6237d8], 0
jne 0x5f8cee
push esp
push 0
push 0
mov eax, dword [0x61bb18]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x6237d8], eax
pop edx
ret
Function at 0x5f9110
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5f9127
add esp, 0xfffffff0
call fcn.00408568
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0047bb7c
mov eax, dword [0x61bbd8]
cmp byte [eax], 0
jne 0x5f9154
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x61bf40]
cmp word [eax + 2], 0
jne 0x5f916e
mov eax, dword [0x61bf40]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005fb5a8
mov eax, dword [0x61c080]
cmp word [eax + 2], 0
jne 0x5f9188
mov eax, dword [0x61c080]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005fb7ac
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x516504]
call fcn.0051ca2c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5fbd24
mov dl, 1
mov eax, dword [0x43e50c]
call fcn.00407e7c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x43e50c]
call fcn.00407e7c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x51b2a0]
call fcn.00526ce8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5f9378
mov eax, dword [0x61bde0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00527204
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5fc00c
mov dl, 1
mov eax, dword [0x43e50c]
call fcn.00407e7c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x61bde0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425034
test eax, eax
je 0x5f92a2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424e8c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425018
test eax, eax
je 0x5f92ba
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a850
push ebx
push 0x5faf88
call fcn.005ee2c0
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x61bbd8]
cmp byte [eax], 0
jne 0x5f930b
mov eax, ebx
call fcn.005f9540
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005fc244
mov eax, ebx
call fcn.005fcecc
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5f936f
call fcn.004085c0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f986c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5f990e
cmp dword [ebx + 0xac], 0
jne 0x5f9908
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5f97ac
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5f9908
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5f98ce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5f9908
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004669b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5f98dd
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5f9bb4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6237b0]
cmp dword [eax + 0x188], 0
je 0x5f9d1d
test bl, bl
jne 0x5f9c70
cmp dword [esi + 0xb4], 0
jne 0x5f9c65
mov eax, esi
call fcn.005fcd1c
push eax
push 0x5f9ab4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5f9c36
mov eax, dword [0x6237b0]
cmp byte [eax + 0xeb], 0
je 0x5f9c36
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5f9c17
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5f9c36
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f9c1f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f9c65
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004669b4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f9c45
inc dword [esi + 0xb4]
jmp 0x5f9d1d
cmp dword [esi + 0xb4], 0
jle 0x5f9d1d
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5f9d1d
cmp dword [esi + 0x58], 0
je 0x5f9cd2
mov eax, dword [0x6237b0]
cmp byte [eax + 0xeb], 0
je 0x5f9cd2
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5f9cb3
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5f9cd2
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f9cbb
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f9d01
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004669b4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f9ce1
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ea930]
call fcn.0040c120
pop edi
pop esi
pop ebx
ret
Function at 0x5faaa4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5fab01
cmp byte [ebx + 0xeb], 0
jne 0x5fab01
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e9c
mov eax, dword [esi]
test eax, eax
je 0x5faaee
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5fab0e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0f4
jmp 0x5fab0e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0f4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5fc458
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5fc4c9
mov eax, esi
call fcn.0054a71c
test al, al
je 0x5fc4c9
mov eax, dword [ebx + 0x98]
call fcn.0054a348
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5fc4c9
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x5fc4ba
push 0
mov eax, dword [ebx + 0x98]
call fcn.0054a348
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00540f20
jmp 0x5fc4c9
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005fc264
pop esi
pop ebx
ret
Function at 0x603e18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x603e9e
mov eax, dword [ebx + 8]
call fcn.0054a348
mov ecx, eax
mov dl, 1
mov eax, dword [0x5585a4]
call fcn.00544460
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.0055ff1c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x6036e8
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054a348
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054a348
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x603f20
mov eax, dword [ebx + 8]
call fcn.0054a348
mov ecx, eax
mov dl, 1
mov eax, dword [0x5585a4]
call fcn.00544460
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.0055ff1c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x603734
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054a348
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054a348
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x603f9e
mov eax, dword [ebx + 8]
call fcn.0054a348
mov ecx, eax
mov dl, 1
mov eax, dword [0x55904c]
call fcn.00544460
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
mov byte [esi + 0x2a0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054a348
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054a348
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x405980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 8]
push eax
mov dword [0x5ab4b0], esi
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push 0x404ee0
push 0
push 0x65
push esi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call edi
test eax, eax
je 0x405a17
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageA]
cmp eax, 0xffffffff
je 0x405a22
lea edx, [ebp - 0x24]
push edx
push esi
call ebx
test eax, eax
jne 0x405a07
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call edi
test eax, eax
jne 0x4059e3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x408370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534f58
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x55eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x408490
cmp byte [edi + 0x49], bl
je 0x408490
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x408484
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x4083e4
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x4083fc
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x408425
dec eax
je 0x408429
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x40847f
jmp 0x40848b
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x408439
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x408462
cmp ebx, 0x10
jae 0x408448
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.005181a2
add esp, 0x10
cmp esi, eax
jne 0x40847c
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x408488
test esi, esi
jne 0x4083f0
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00405a70
jmp 0x4083ea
lea ecx, [ebp - 0x2c]
call fcn.00406260
xor al, al
jmp 0x408492
lea ecx, [ebp - 0x2c]
call fcn.00406260
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516d3a
mov esp, ebp
pop ebp
ret
Function at 0x409590
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5349eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x55eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005018cb
push 4
mov dword [ebp - 4], 0
call fcn.005183e9
mov edi, eax
add esp, 4
test edi, edi
je 0x40960c
call fcn.005016c6
mov dword [edi], eax
call fcn.00501485
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0050188c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x409602
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.005018b4
jmp 0x40960e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534e38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x55eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00516fa5
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.004079c0
mov dword [esi], vtable.boost::filesystem2::basic_filesystem_error_class_boost::filesystem2::basic_path_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____struct_boost::filesystem2::path_traits__.0
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov edi, dword [edi + 0x34]
mov dword [esi + 0x34], edi
test edi, edi
je 0x40e21f
add edi, 4
mov ecx, 1
lock xadd dword [edi], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4117d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, edx
je 0x411800
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x4117e1
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
pop ebp
ret

Function at 0x419bb2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x419bc6
mov eax, dword [ebp + 0x10]
mov dword [0x5ad91c], eax
jmp 0x419bd0
mov dword [0x5ad91c], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x5ad918], ecx
cmp dword [0x56080c], 0
je 0x419bf1
mov edx, dword [0x5ad924]
push edx
call dword [0x5381c0]
jmp 0x419c62
push 0
push 0
push 1
push 0
call dword [0x5381c4]
mov dword [0x5ad924], eax
cmp dword [0x5ad924], 0
jne 0x419c11
xor eax, eax
jmp 0x419c67
push 4
push 1
call fcn.00518f7a
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x419c2a
xor eax, eax
jmp 0x419c67
mov eax, dword [ebp - 4]
mov ecx, dword [0x5ad924]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x419b1f
call fcn.0051a02c
add esp, 0xc
mov dword [0x56080c], eax
push 0
call dword [0x5381f0]
cmp dword [0x56080c], 0
jne 0x419c62
xor eax, eax
jmp 0x419c67
mov eax, dword [0x56080c]
mov esp, ebp
pop ebp
ret

Function at 0x419c89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.0051a15a
add esp, 4
mov dword [0x560804], eax
cmp dword [0x560804], 0
je 0x419cb0
mov eax, dword [0x560804]
jmp 0x419d29
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
push 0x549de0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419d27
mov dword [ebp - 0xc], 0xc7
lea edx, [ebp - 0xc]
push edx
push 0x56073c
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419d19
mov dword [0x560804], 0x56073c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x560804]
jmp 0x419d29
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419d29
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x428828
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x80000002
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00429d87
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x428924
push 0
call fcn.004289b6
add esp, 4
push 1
call fcn.004289b6
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x428924
mov eax, dword [ebp - 0xc]
push eax
call fcn.00415dce
add esp, 4
cmp dword [ebp + 8], 0
je 0x42891a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x4288e9
xor edx, edx
test edx, edx
je 0x4288e9
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x4288f0
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00419d30
add esp, 0x1c
mov eax, 1
jmp 0x4289b2
mov edx, dword [ebp - 0xc]
push edx
call fcn.00415dce
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x42894c
cmp dword [ebp + 0x14], 0
jne 0x42895c
mov eax, dword [ebp + 0x10]
push eax
call fcn.005197d0
add esp, 4
test eax, eax
jne 0x42895c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4289a6
cmp dword [ebp + 0x14], 0
je 0x42896a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x42897c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005197d0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045d783
add esp, 0x18
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret