joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a0cb880
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 8
Function at 0x6a0cd930
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0xc]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6a0cd990
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov edx, dword [eax + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
test edx, edx
je 0x6a0cd9ed
mov eax, dword [eax + 0x10]
test eax, eax
je 0x6a0cd9c7
xor ebx, ebx
mov eax, ebx
shl eax, 5
add eax, edx
je 0x6a0cd9c1
call sym._free_variable.part.0
mov edx, dword [esi + 0x1c]
inc ebx
cmp dword [esi + 0x10], ebx
ja 0x6a0cd9b0
mov dword [esp + 8], edx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov edx, dword [esi + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6a0ceaa0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
test eax, eax
je 0x6a0ceb10
mov esi, edx
mov dword [esp], eax
mov ebx, eax
mov edi, 1
call dword [sym.imp.ucrtbase.dll_strlen]
lea edx, [eax + 1]
test eax, eax
je 0x6a0ceb06
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov dword [esi], eax
je 0x6a0ceb1f
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcpy
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov edi, 1
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
xor edi, edi
test byte [0x6a0de160], 2
je 0x6a0ceb06
mov dword [esp + 0xc], str.Failed_to_allocate_name_memory._n
mov dword [esp + 8], str.copy_name
mov dword [esp + 4], 0x6a0de160
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a0ceb06

Function at 0x6a0cebc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
test byte [0x6a0de160], 8
jne 0x6a0cec28
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 8]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Free_signature__p_n
mov dword [esp + 8], str.free_signature
mov dword [esp + 4], 0x6a0de160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a0cebd4
Function at 0x6a0d00d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6a0de160], 8
jne 0x6a0d0110
test ebx, ebx
je 0x6a0d0140
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p_decreasing_refcount_to__lu._n
mov dword [esp + 8], str.d3dcompiler_shader_reflection_Release
mov dword [esp + 4], 0x6a0de160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
test ebx, ebx
jne 0x6a0d00fd
mov eax, esi
call sym._reflection_cleanup
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x6a0d4a60
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
test byte [0x6a0de180], 8
jne 0x6a0d4ac8
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jae 0x6a0d4b10
mov ecx, dword [ebp + 0xc]
lea eax, [eax + eax*2]
mov dword [edx + eax*4], ecx
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], esi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edx
inc dword [ebx + 4]
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp + 0xc]
call sym._wine_dbgstr_an.constprop.0_2
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p__tag__s__size__Ix._n
mov dword [esp + 8], 0x6a0e834c
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jb 0x6a0d4a88
lea edi, [ecx + ecx]
mov dword [esp + 8], edx
lea ecx, [edi + ecx*4]
mov dword [esp + 4], 0
shl ecx, 2
mov dword [esp + 0xc], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x6a0d4b54
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
mov dword [ebx], edi
jmp 0x6a0d4a88
mov ebx, 0x8007000e
test byte [0x6a0de180], 2
je 0x6a0d4ab7
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], 0x6a0e834c
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a0d4ab7

Function at 0x6a0d4b90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x6a0de180], 8
jne 0x6a0d4c08
test ebx, ebx
je 0x6a0d4bf8
lea eax, [ebx + ebx*2]
shl eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 8], eax
sub esp, 0xc
test eax, eax
je 0x6a0d4c39
mov dword [esi + 4], 0
mov dword [esi], ebx
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, 0x18
mov ebx, 2
jmp 0x6a0d4bb1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.dxbc__p__size__u._n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a0d4ba7
mov ebx, 0x8007000e
test byte [0x6a0de180], 2
je 0x6a0d4be8
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a0d4be8
Function at 0x6a0d5010
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x6a0de180], 8
jne 0x6a0d5050
mov edx, dword [ebx + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p._n
mov dword [esp + 8], str.dxbc_destroy
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a0d5023
Function at 0x6a0d53f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 8]
test edi, edi
je 0x6a0d5510
mov edx, dword [ebx]
mov esi, dword fs:[0x18]
jmp 0x6a0d5449
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov edx, eax
sub esp, 0x10
test edx, edx
je 0x6a0d54d8
mov dword [ebx], edx
mov dword [ebx + 8], edi
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, edi
sub eax, dword [ebx + 4]
mov dword [esp + 0xc], eax
add edx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov edi, eax
mov eax, dword [ebx + 8]
test edi, edi
js 0x6a0d5498
mov edx, dword [ebx + 4]
mov ecx, eax
sub ecx, edx
cmp ecx, edi
ja 0x6a0d54f0
lea edi, [eax + eax]
mov eax, dword [ebx]
test eax, eax
jne 0x6a0d5418
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
sub esp, 0xc
test edx, edx
jne 0x6a0d5444
lea esi, [esi]
nop
test byte [0x6a0de180], 2
jne 0x6a0d5558
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6a0de180], 8
jne 0x6a0d5588
add edx, edi
mov dword [ebx + 4], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6a0d55ba
mov dword [ebx + 8], 0x100
mov edi, 0x100
jmp 0x6a0d5409
mov dword [esp + 0xc], str.Error_reallocating_memory_for_parser_messages_n
mov dword [esp + 8], 0x6a0e82dc
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add edx, dword [ebx]
mov dword [esp + 0xc], 0x6a0e72d4
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x6a0e82dc
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov edx, dword [ebx + 4]
jmp 0x6a0d54fd
test byte [0x6a0de180], 2
je 0x6a0d54e1
mov dword [esp + 0xc], str.Error_allocating_memory_for_parser_messages_n
mov dword [esp + 8], 0x6a0e82dc
mov dword [esp + 4], 0x6a0de180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a0d54e1
Function at 0x6a0d56a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov eax, dword [edx + 8]
add dword [ebx + 4], eax
mov eax, dword [edx]
test eax, eax
jne 0x6a0d56c8
mov dword [ebx + 8], 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0x14
mov esi, edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 8], eax
sub esp, 0xc
test eax, eax
je 0x6a0d56bd
mov edx, dword [esi + 4]
mov dword [eax], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6a0da9a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [0x6a0f1084], 0
mov dword [0x6a0f108c], 0
mov dword [0x6a0f1098], 0
mov dword [0x6a0f1094], 0
mov dword [0x6a0f109c], 1
call sym._asmshader_parse
cmp dword [0x6a0f108c], 2
mov ebx, dword [0x6a0f1084]
je 0x6a0daaa0
test esi, esi
je 0x6a0daac0
mov eax, dword [0x6a0f1094]
test eax, eax
jne 0x6a0daa18
mov dword [esi], 0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov edx, dword [0x6a0f1090]
inc eax
test edx, edx
je 0x6a0daad8
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x6a0daa0c
test byte [0x6a0de190], 2
jne 0x6a0dab08
mov edx, dword [0x6a0f1090]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test ebx, ebx
je 0x6a0da9f5
mov dword [esp], ebx
xor ebx, ebx
call sym._SlDeleteShader
test esi, esi
jne 0x6a0da9fd
lea esi, [esi]
mov eax, dword [0x6a0f1098]
test eax, eax
jne 0x6a0daa63
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6a0daa50
mov dword [esp + 0xc], 0x6a0e9408
mov dword [esp + 8], str.parse_asm_shader
mov dword [esp + 4], 0x6a0de190
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_5
jmp 0x6a0daa63

Function at 0x6a0daca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6a0eab20
mov dword [esp], eax
call sym._fprintf.constprop.0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
nop
Function at 0x6a0dc980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6a0dc9db
cmp byte [esi + ebx - 1], 0xa
je 0x6a0dc9af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6a0f1184], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401100
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x402648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0x4042b8
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x104
call fcn.004021ee
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0
push eax
push 0x20019
push 0
push 0x404030
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4011ec
push 0x104
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
push edx
push 0
push 0x4042b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x404020
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 4], eax
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 4]
je 0x4011f8
call sub.MFC42.DLL_CString::CString
mov eax, 1
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x401480
Capabilities:
Access peb ldr_data
Get kernel32 base address
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40268b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
lea ecx, [esi + 0x20]
call fcn.00401050
lea ecx, [esi + 0x30]
mov dword [esp + 0x28], 0
call fcn.00401320
lea eax, [esp + 0x14]
lea edi, [esi + 4]
push eax
push 0x20019
lea ebp, [esi + 8]
push 0
mov ebx, 4
push 0x40416c
push 0x80000002
mov dword [esi], 0x403218
mov dword [esp + 0x2c], ebx
mov dword [edi], 0
mov dword [ebp], 0
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0x32
mov dword [esi + 0x18], 0x258
mov dword [esi + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401609
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
push eax
mov eax, dword [esp + 0x24]
push 0x404158
push eax
mov dword [esp + 0x28], ebx
call edi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
push 0
push 0x404148
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0xc]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404138
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x10]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404124
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x14]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404110
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x18]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x4040fc
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
mov dword [esp + 0x20], ebx
push 0x4040e4
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40149a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40268b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
lea ecx, [esi + 0x20]
call fcn.00401050
lea ecx, [esi + 0x30]
mov dword [esp + 0x28], 0
call fcn.00401320
lea eax, [esp + 0x14]
lea edi, [esi + 4]
push eax
push 0x20019
lea ebp, [esi + 8]
push 0
mov ebx, 4
push 0x40416c
push 0x80000002
mov dword [esi], 0x403218
mov dword [esp + 0x2c], ebx
mov dword [edi], 0
mov dword [ebp], 0
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0x32
mov dword [esi + 0x18], 0x258
mov dword [esi + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401609
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
push eax
mov eax, dword [esp + 0x24]
push 0x404158
push eax
mov dword [esp + 0x28], ebx
call edi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
push 0
push 0x404148
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0xc]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404138
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x10]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404124
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x14]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x404110
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x18]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
push 0x4040fc
push eax
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0
mov dword [esp + 0x20], ebx
push 0x4040e4
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x403a2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00403934
push 0x28
call fcn.004038c5
test eax, eax
je 0x403a5e
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 1
mov dword [eax], 0x41cc04
mov dword [ebp - 4], eax
jmp 0x403a62
and dword [ebp - 4], 0
mov esi, dword [ebp - 4]
test esi, esi
je 0x403b2f
call fcn.004051c1
test eax, eax
jne 0x403b27
push 0x14
pop ebx
mov esi, ebx
call fcn.004038a4
mov esi, eax
test esi, esi
je 0x403b27
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
xor eax, eax
cmp dword [0x41e1ec], eax
push ebx
setne cl
xor cl, byte [edi + 0xb]
push edi
and cl, 1
xor byte [edi + 0xb], cl
mov cx, word [0x41e1fc]
mov word [edi + 8], cx
mov ecx, dword [0x41e1f0]
or byte [edi + 0xb], 6
mov dword [edi], ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 4], ecx
mov ecx, dword [0x41e1f4]
mov dword [edi + 0xc], ecx
mov cl, byte [0x41e1f8]
push eax
mov byte [edi + 0xa], cl
mov dword [edi + 0x10], eax
call dword [0x4061c0]
push 5
mov dword [edi + 0x10], eax
pop ecx
mov eax, 0x4c4f4e47
xor dword [edi], eax
rol eax, 1
add edi, 4
dec ecx
jne 0x403aee
movzx eax, word [0x4061e8]
mov ebx, dword [ebp - 4]
push eax
push dword [0x4061e0]
mov eax, esi
call fcn.0040525c
push 0x3500
push 0xea825542
mov eax, esi
call fcn.0040525c
push esi
call fcn.0040388e
mov ecx, dword [ebp - 4]
call fcn.004038ed
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40549c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4054b6
push edx
je fcn.00405510
dec ecx
outsb dx, byte [esi]
imul esi, dword [ebp + edx*2 + 0x6e], 0x646f6369
push ebx
je 0x405524
imul ebp, dword [esi + 0x67], 0x182e800
add byte [eax], al
jmp eax

Function at 0x4054bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4054cd
dec esp
jb 0x405512
outsd dx, dword [esi]
popal
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add al, ch
imul eax, dword [ecx], 0
add bh, bh
loopne fcn.004054bd
invalid
or al, 0
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x466c6175
jb 0x405548
add byte gs:[eax - 0x3d], bl
and byte [ebx - 0x30fce7c0], cl

Function at 0x405510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
call 0x405529
imul eax, dword [eax], 0x65
add byte [edx], dh
outsb dx, byte [esi]
add byte [ebp], ah
insb byte es:[edi], dx
add byte [ebx], dh
add byte [edx], dh
add byte [eax], al
add byte [eax - 0x3d], bl

Function at 0x405529
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
call 0x405529
imul eax, dword [eax], 0x65
add byte [edx], dh
outsb dx, byte [esi]
add byte [ebp], ah
insb byte es:[edi], dx
add byte [ebx], dh
add byte [edx], dh
add byte [eax], al
add byte [eax - 0x3d], bl