joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410330
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x9c
mov eax, dword [0x459f34]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
mov edi, dword [esp + 0xb0]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0xa
lea edx, [esp + 0xa8]
push edx
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
push 0x11e0
call sub.mfc90.dll_Ordinal_265
push 0x11e0
push 0
push eax
mov dword [esp + esi*4 + 0x2c], eax
call sub.MSVCR90.dll_memset
inc esi
add esp, 0x10
cmp esi, 0x20
jl 0x410382
mov eax, str.UEMAPD3
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4103b0
mov esi, dword [sym.imp.MSVCR90.dll_strncmp]
sub eax, edx
push eax
lea eax, [esp + 0xa0]
push str.UEMAPD3
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x4103ef
mov ecx, dword [esp + 0x10]
push ebx
push ecx
push ebp
push edi
call fcn.00411610
add esp, 0x10
mov dword [esp + 0x10], eax
jmp 0x410502
mov eax, str.UEMAPD
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4103f7
sub eax, edx
push eax
lea edx, [esp + 0xa0]
push str.UEMAPD
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x410430
mov eax, dword [esp + 0x10]
push ebx
push eax
push ebp
push edi
call fcn.00411290
add esp, 0x10
mov dword [esp + 0x10], eax
jmp 0x410502
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebp
push edi
call fcn.00410240
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
je 0x410502
lea ebp, [esp + 0x1c]
mov eax, ebx
sub ebp, ebx
mov dword [esp + 0x14], 0x20
lea ecx, [ecx]
xor ebx, ebx
xor edx, edx
mov esi, dword [eax + ebp]
mov edi, dword [eax]
add esi, edx
add edi, ebx
mov ecx, 0x23
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + ebp]
lea esi, [ecx + edx + 0x8f]
mov ecx, dword [eax]
lea edi, [ebx + ecx + 0x15f]
mov ecx, 0x23
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + ebp]
lea esi, [ecx + edx + 0x11e]
mov ecx, dword [eax]
lea edi, [ebx + ecx + 0x2be]
mov ecx, 0x23
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [eax + ebp]
mov edi, dword [eax]
lea ecx, [edx + 0x1ad]
add esi, ecx
lea ecx, [ebx + 0x41d]
add edi, ecx
mov ecx, 0x23
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add edx, 0x23c
add ebx, 0x57c
cmp edx, 0x11e0
movsb byte es:[edi], byte [esi]
jl 0x410474
add eax, 4
sub dword [esp + 0x14], 1
jne 0x410470
xor esi, esi
mov edx, dword [esp + esi*4 + 0x1c]
push edx
call sub.mfc90.dll_Ordinal_266
inc esi
add esp, 4
cmp esi, 0x20
jl 0x410504
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00429cfe
add esp, 0x9c
ret
Function at 0x4110a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x434ba3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push 0
push 0
push 7
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
push 0x44
lea edx, [ebp + ecx*4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411251
cmp dword [esp + 0x18], 0
je 0x411251
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
lea edx, [ebp + ecx*4 + 4]
push edx
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x438d18
mov ecx, eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
lea ecx, [esp + 0x38]
sete bl
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
jne 0x41126a
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
mov dword [ebp + ecx*4], eax
mov eax, dword [esi]
mov edx, eax
shl edx, 4
add edx, eax
cmp dword [ebp + edx*4 + 0x40], 0
mov dword [esp + 0x34], 0
jbe 0x411229
xor edi, edi
mov ecx, dword [esi]
mov ebx, dword [esp + 0x3c]
mov edx, dword [ebx + ecx*4]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x38]
push 0x8f
add edx, edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4111e5
mov ecx, dword [esi]
mov edx, dword [ebx + ecx*4]
lea eax, [edx + edi + 8]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov ecx, 1
or dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
push 0x438d18
mov ecx, eax
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test byte [esp + 0x14], 1
mov dword [esp + 0x28], 0xffffffff
je 0x411203
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esi]
mov ecx, dword [esp + 0x34]
mov edx, eax
shl edx, 4
inc ecx
add edx, eax
add edi, 0x8f
mov dword [esp + 0x34], ecx
cmp ecx, dword [ebp + edx*4 + 0x40]
jb 0x411190
mov edi, dword [esp + 0x30]
inc dword [esi]
mov eax, dword [esi]
push 0
mov edx, eax
lea ecx, [esp + 0x1c]
push ecx
shl edx, 4
add edx, eax
push 0x44
lea eax, [ebp + edx*4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41110e
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x411610
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x434ba3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push 0
push 0
push 8
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
push 0x44
lea edx, [ebp + ecx*4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4117c1
cmp dword [esp + 0x18], 0
je 0x4117c1
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
lea edx, [ebp + ecx*4 + 4]
push edx
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x438d18
mov ecx, eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
lea ecx, [esp + 0x38]
sete bl
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
jne 0x4117da
mov eax, dword [esi]
mov ecx, eax
shl ecx, 4
add ecx, eax
mov dword [ebp + ecx*4], eax
mov eax, dword [esi]
mov edx, eax
shl edx, 4
add edx, eax
cmp dword [ebp + edx*4 + 0x40], 0
mov dword [esp + 0x34], 0
jbe 0x411799
xor edi, edi
mov ecx, dword [esi]
mov ebx, dword [esp + 0x3c]
mov edx, dword [ebx + ecx*4]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x38]
push 0x15f
add edx, edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411755
mov ecx, dword [esi]
mov edx, dword [ebx + ecx*4]
lea eax, [edx + edi + 8]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov ecx, 1
or dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
push 0x438d18
mov ecx, eax
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test byte [esp + 0x14], 1
mov dword [esp + 0x28], 0xffffffff
je 0x411773
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esi]
mov ecx, dword [esp + 0x34]
mov edx, eax
shl edx, 4
inc ecx
add edx, eax
add edi, 0x15f
mov dword [esp + 0x34], ecx
cmp ecx, dword [ebp + edx*4 + 0x40]
jb 0x411700
mov edi, dword [esp + 0x30]
inc dword [esi]
mov eax, dword [esi]
push 0
mov edx, eax
lea ecx, [esp + 0x1c]
push ecx
shl edx, 4
add edx, eax
push 0x44
lea eax, [ebp + edx*4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41167e
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x415960
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4353b5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.PlaynBackup.exe
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov ecx, esi
mov byte [esp + 0x30], 3
call fcn.004147a0
mov edi, eax
lea eax, [esp + 0x24]
push eax
call fcn.00417e90
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov ebp, dword [sym.imp.mfc90.dll_Ordinal_2539]
push ecx
push edx
lea eax, [esp + 0x24]
push str._s_s
push eax
mov byte [esp + 0x44], 4
call ebp
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push 0x8026
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2538]
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.0041ab30
push 0
push str.WindowPosition
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], 5
call fcn.0041ab50
mov eax, dword [esi + edi*4 + 0x4e0]
mov ecx, dword [eax + 0xa0]
mov edi, dword [eax + 0xa4]
call fcn.0040a460
mov ecx, dword [esi + 0x580]
mov edx, dword [esi + 0xa4]
push ecx
mov ecx, dword [esi + 0xa0]
push 0x439528
movzx eax, al
push eax
mov eax, dword [esi + 0x94]
push 0x439528
push edx
mov edx, dword [esi + 0x98]
push 0x439528
push edi
push 0x439528
push eax
mov eax, dword [esi + 0x9c]
push 0x439528
push ecx
mov ecx, dword [esi + 0x90]
push 0x439528
push edx
push 0x439528
push eax
push 0x439528
push ecx
push 0x439528
mov ecx, 0x86b33c
call fcn.00411840
push eax
push 0x439528
lea edx, [esp + 0x64]
push str._s_d_s_s_s_s_s_s_s_s_s_s_s_d_s_d_s_d_s_d
push edx
call ebp
add esp, 0x58
push 1
push 0
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x415b16
push 0
push 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call sub.mfc90.dll_Ordinal_1183
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 3
call fcn.0041ab40
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x417280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4354e3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0041ab30
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], 0
call fcn.00417e90
push str.Backup_
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x30], 1
call fcn.00404c90
add esp, 0x10
push eax
push str.BackupPath
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.00416c00
push eax
lea ecx, [esi + 0xdc]
mov byte [esp + 0x24], 3
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0
push str.CopySimplePlayer
lea ecx, [esp + 0x10]
call fcn.0041ab50
push 0
mov ecx, esi
mov dword [esi + 0xe0], eax
call sub.mfc90.dll_Ordinal_6740
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041ab40
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x417e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x435714
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x459f34]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x324]
mov dword fs:[0], eax
mov esi, dword [esp + 0x334]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0xc]
mov edi, eax
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x104
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x334], 0
call dword [sym.imp.mfc90.dll_Ordinal_2691]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_5835]
push 0x100
lea eax, [esp + 0x124]
push eax
push 0x100
lea ecx, [esp + 0x22c]
push ecx
push 0x104
lea edx, [esp + 0x30]
push edx
push 3
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.MSVCR90.dll__splitpath_s]
add esp, 0x24
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov edi, eax
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x330], 1
call dword [sym.imp.mfc90.dll_Ordinal_310]
push edi
push eax
push esi
mov byte [esp + 0x338], 2
call fcn.004118b0
add esp, 0xc
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x324]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.00429cfe
add esp, 0x324
ret
Function at 0x417fe0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x435774
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0
call dword [sym.imp.mfc90.dll_Ordinal_5997]
push 0x43b104
mov ecx, eax
mov byte [esp + 0x28], 1
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
lea ecx, [esp + 0x18]
setne bl
mov byte [esp + 0x24], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x418059
push 0x43b104
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_945]
push 0
push 0x43b104
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
lea ecx, [esp + 0x14]
mov esi, eax
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x24], 2
test esi, esi
jle 0x4180fd
mov edi, dword [sym.imp.MSVCR90.dll__access]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov bl, 3
lea ecx, [ecx]
push esi
push 0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_4507]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call edi
add esp, 8
cmp eax, 0xffffffff
jne 0x4180e6
push 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call ebp
inc esi
push esi
push 0x43b104
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
mov esi, eax
test esi, esi
jg 0x418090
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x418160
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
test edi, edi
jbe 0x418186
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
add ecx, dword [esi + 0x10]
push edi
push eax
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, dword [esi + 0x10]
cmp eax, 0xa
jbe 0x41821b
xor ebp, ebp
add eax, 0xfffffff6
je 0x41821b
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esi + 0x14]
cmp byte [edx + ebp], 0xfb
lea eax, [edx + ebp]
jne 0x418210
cmp byte [eax + 1], 0xfb
jne 0x418210
cmp byte [eax + 2], 0xfb
jne 0x418210
cmp byte [eax + 3], 0xfc
jne 0x418210
mov ecx, dword [eax + 4]
add eax, 4
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov eax, dword [esi + 6]
push eax
lea edi, [ebp + 0xa]
call ebx
lea ecx, [eax + 4]
mov dword [esi + 0xc], ecx
cmp ecx, 0x80400
ja 0x41821b
mov edx, dword [esi + 0x10]
sub edx, edi
cmp ecx, edx
ja 0x418210
mov ecx, dword [esi + 0x14]
add ecx, edi
add eax, ecx
cmp byte [eax], 0xfb
jne 0x418210
cmp byte [eax + 1], 0xfb
jne 0x418210
cmp byte [eax + 2], 0xfb
jne 0x418210
cmp byte [eax + 3], 0xfd
je 0x418224
mov edx, dword [esi + 0x10]
inc ebp
sub edx, 0xa
cmp ebp, edx
jb 0x4181a3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
mov al, byte [esi + 5]
mov ebx, dword [esp + 0x14]
mov byte [ebx], al
mov eax, dword [esi + 0xc]
add eax, 0xfffffffc
mov dword [ebx + 1], eax
mov ecx, dword [esi + 0x14]
push eax
add ecx, edi
push ecx
lea edx, [ebx + 5]
push edx
call sub.MSVCR90.dll_memcpy
mov eax, dword [ebx + 1]
add eax, edi
sub dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0x14]
mov ecx, dword [ebx + 1]
add ecx, esi
push eax
add ecx, edi
push ecx
push esi
call dword [sym.imp.MSVCR90.dll_memmove]
add esp, 0x18
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x418300
Capabilities:
Write file on windows

Disassembly:
cmp dword [ecx + 0x2c], 1
push 0
jne 0x418321
lea eax, [esp + 8]
push eax
push 0x14
add ecx, 4
push ecx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 4
mov eax, dword [esp + 8]
lea edx, [esp + 8]
push edx
push 0x14
add ecx, 0x18
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 4
Function at 0x418660
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x435818
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x459f34]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x459f34]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x68]
mov esi, ecx
cmp byte [esi + 0x1e6d], 0
mov dword [esp + 0x14], eax
je 0x418804
mov ecx, edi
call fcn.0040bf50
movzx eax, al
cmp dword [esi + eax*4 + 4], 0
je 0x418804
push eax
mov ecx, esi
call fcn.004185a0
test al, al
je 0x418804
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.0040bfe0
mov ebp, dword [eax]
mov edx, dword [eax + 4]
push ebp
mov ecx, esi
mov dword [esp + 0x20], edx
call fcn.004185c0
test al, al
jne 0x418804
cmp dword [esi + 0x1e78], 0
jne 0x4187bf
lea ecx, [esp + 0x24]
call fcn.004183f0
mov eax, dword [edi + 0xc4]
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x64], 0
call fcn.004182f0
mov eax, dword [esi + 0x4c]
mov edx, dword [eax + 0x14]
lea ebx, [esi + 0x4c]
push 0xffffffffffffffff
mov ecx, ebx
call edx
mov ecx, edi
call fcn.0040c020
movzx eax, al
push eax
mov ecx, edi
call fcn.0040bf50
movzx ecx, al
push ecx
mov ecx, edi
call fcn.0040c050
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esi + 0x1e58]
push edx
push ebp
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
lea ecx, [esp + 0x3c]
call fcn.00418370
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x1e58]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x1e5c]
push edx
lea ecx, [esp + 0x28]
call fcn.00418300
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov ecx, ebx
call edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], 0xffffffff
call fcn.004182e0
jmp 0x418804
mov ecx, edi
call fcn.0040bf50
lea ebp, [esi + 0x4c]
movzx ebx, al
mov eax, dword [ebp]
mov edx, dword [eax + 0x14]
push 0xffffffffffffffff
mov ecx, ebp
call edx
imul ebx, ebx, 0x1e0
lea esi, [ebx + esi + 0x54]
mov ecx, esi
call fcn.00402e60
test al, al
je 0x4187fa
mov eax, dword [esp + 0x14]
push eax
push edi
mov ecx, esi
call fcn.00402de0
mov edx, dword [ebp]
mov eax, dword [edx + 0x1c]
mov ecx, ebp
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00429cfe
add esp, 0x50
ret 0xc
Function at 0x418860
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x418890
xor eax, eax
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, edx
push esi
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4188a0
mov ecx, dword [esp + 0x10]
sub eax, esi
inc eax
push eax
push edx
mov edx, dword [esp + 0x14]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
test eax, eax
jne 0x41888b
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret 0x10

Function at 0x4188e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x418909
xor eax, eax
pop ebx
pop ecx
ret 0x14
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push ecx
call edi
test eax, eax
je 0x418943
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x14
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x418979
mov ecx, dword [esp + 0x18]
push ecx
call esi
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x14
mov edx, dword [esp + 0x18]
push edx
call esi
push ebx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0x14