joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98fe20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x78d015
lea edi, [esi - 0x38c015]
push edi
jmp 0x98fe3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x98fe41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x98fe30
mov eax, 1
add ebx, ebx
jne 0x98fe53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x98fe64
jne 0x98fe83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x98fe83
dec eax
add ebx, ebx
jne 0x98fe70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x98fe48
add ebx, ebx
jne 0x98fe7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x98fed5
xor ecx, ecx
sub eax, 3
jb 0x98fe9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x98ff0a
sar eax, 1
mov ebp, eax
jmp 0x98fea6
add ebx, ebx
jne 0x98fea6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x98fe74
inc ecx
add ebx, ebx
jne 0x98feb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x98fe74
add ebx, ebx
jne 0x98fec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x98feb6
jne 0x98fed2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x98feb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x98fef4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x98fee6
jmp 0x98fe36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x98fef4
add edi, ecx
jmp 0x98fe36
pop esi
mov edi, esi
mov ecx, 0xf111
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x98ff12
cmp byte [edi], 0x26
jne 0x98ff12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x98ff17
lea edi, [esi + 0x58d000]
mov eax, dword [edi]
or eax, eax
je 0x98ff86
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x58f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x58f028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x98ff44
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x58f030]
or eax, eax
je 0x98ff80
mov dword [ebx], eax
add ebx, 4
jmp 0x98ff61
call dword [esi + 0x58f02c]
mov ebp, dword [esi + 0x58f034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x98ffba
sub esp, 0xffffff80
jmp 0x44d510
Function at 0x4043d0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea edx, [ebp - 0x10]
push ebx
push edx
lea edx, [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xor eax, eax
push edx
lea edx, [ebp - 8]
push eax
push edx
push eax
push ecx
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call ebx
test eax, eax
jne 0x404465
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404465
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push dword [ebp - 8]
push 8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
lea eax, [eax + eax + 2]
push eax
push 8
call esi
push eax
call edi
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push edi
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push 0
call ebx
mov ebx, eax
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
pop edi
pop esi
je 0x404465
mov eax, dword [ebp - 0xc]
jmp 0x404467
xor eax, eax
pop ebx
leave
ret

Function at 0x4044ea
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
and dword [ebp - 4], 0
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov edi, edx
lea ecx, [ebp - 4]
push 0x2002
call fcn.0040859a
test al, al
jne 0x404511
xor bl, bl
jmp 0x404547
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40450d
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40450d
and dword [ebp - 4], 0
mov bl, 1
lea ecx, [ebp - 4]
call fcn.004085bb
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404b18
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x404b26
and edx, 0x3fff
jmp fcn.00404a8a

Function at 0x404b2b
Capabilities:
Delete directory

Disassembly:
mov eax, 0x45fb20
call fcn.0045f4a0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407d89
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404b5a
push edi
call esi
test eax, eax
je 0x404b5a
mov al, 1
jmp 0x404b9e
test ebx, ebx
je 0x404b9c
lea ecx, [ebp - 0x18]
call fcn.00402410
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407e92
test al, al
push dword [ebp - 0x18]
je 0x404b96
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402de4
test esi, esi
pop ecx
setne al
jmp 0x404b9e
call fcn.00402de4
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404bad
Capabilities:
Move file

Disassembly:
mov eax, 0x45fb3c
call fcn.0045f4a0
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00407d89
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00407d89
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x404bf6
cmp eax, ebx
je 0x404bf6
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x404bf6
mov al, bl
jmp 0x404c6d
test esi, esi
jne 0x404bff
cmp dword [ebp - 0x14], esi
je 0x404c6b
lea ecx, [ebp - 0x30]
call fcn.00402410
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00402410
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x404c1f
cmp dword [ebp - 0x14], ebx
jne 0x404c21
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004083ad
test al, al
push dword [ebp - 0x24]
je 0x404c5c
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00402de4
push dword [ebp - 0x30]
call fcn.00402de4
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x404c6d
call fcn.00402de4
push dword [ebp - 0x30]
call fcn.00402de4
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404d78
Capabilities:
Create directory

Disassembly:
mov eax, 0x45fb6c
call fcn.0045f4a0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407d89
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404db6
push 0
push edi
call esi
test eax, eax
je 0x404da9
mov al, 1
jmp 0x404dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404dfd
test ebx, ebx
je 0x404dfd
lea ecx, [ebp - 0x18]
call fcn.00402410
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407e92
test al, al
je 0x404df4
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402de4
test esi, esi
pop ecx
setne al
jmp 0x404dff
push dword [ebp - 0x18]
call fcn.00402de4
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404f4f
Capabilities:
Create directory

Disassembly:
mov eax, 0x45fbaf
call fcn.0045f4a0
sub esp, 0x7c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00407d89
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 1
je 0x404f94
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404f87
mov al, 1
jmp 0x40507b
call ebx
cmp eax, 0xb7
je 0x40502a
test edi, edi
je 0x40502a
lea ecx, [ebp - 0x18]
call fcn.00402410
and dword [ebp - 4], 0
cmp edi, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, esi
call fcn.00407e92
test al, al
je 0x40501d
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404fd0
mov bl, 1
jmp 0x405018
call ebx
cmp eax, 0xb7
je 0x404fdd
xor bl, bl
jmp 0x405018
lea ecx, [ebp - 0x50]
call fcn.004057dc
lea ecx, [ebp - 0x28]
call fcn.00402410
push 0
lea ecx, [ebp - 0x50]
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00405c5e
test al, al
jne 0x405006
xor bl, bl
jmp 0x40500f
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00402de4
pop ecx
push dword [ebp - 0x18]
jmp 0x405073
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00402de4
pop ecx
call ebx
cmp eax, 0xb7
je 0x405037
xor al, al
jmp 0x40507b
lea ecx, [ebp - 0x88]
call fcn.004057dc
lea ecx, [ebp - 0x60]
call fcn.00402410
push 0
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 2
call fcn.00405c5e
test al, al
jne 0x405067
xor bl, bl
jmp 0x405070
mov ebx, dword [ebp - 0x68]
shr ebx, 4
and bl, 1
push dword [ebp - 0x60]
call fcn.00402de4
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40508a
Capabilities:
Delete file

Disassembly:
mov eax, 0x45fbc4
call fcn.0045f4a0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00405be1
cmp eax, 0xffffffff
je 0x4050be
test al, 0x10
jne 0x4050be
test al, 1
je 0x4050be
mov edx, eax
mov ecx, edi
and edx, 0xfffffffe
call fcn.00404a8a
test al, al
je 0x40511f
mov ecx, edi
call fcn.00407d89
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
cmp ebx, 1
je 0x4050dd
push edi
call esi
test eax, eax
je 0x4050dd
mov al, 1
jmp 0x405121
test ebx, ebx
je 0x40511f
lea ecx, [ebp - 0x18]
call fcn.00402410
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407e92
test al, al
push dword [ebp - 0x18]
je 0x405119
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402de4
test esi, esi
pop ecx
setne al
jmp 0x405121
call fcn.00402de4
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405be1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x45fcb8
call fcn.0045f4a0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407d89
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405c0d
push edi
call esi
cmp eax, 0xffffffff
jne 0x405c4f
test ebx, ebx
je 0x405c4c
lea ecx, [ebp - 0x18]
call fcn.00402410
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00407e92
test al, al
push dword [ebp - 0x18]
je 0x405c46
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00402de4
pop ecx
mov eax, esi
jmp 0x405c4f
call fcn.00402de4
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40653c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x45fd98
call fcn.0045f4a0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.004198b3
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x406612
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406578
mov eax, ebx
add eax, eax
push eax
call fcn.00402db0
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x40660b
cmp ebx, dword [ebp - 0x18]
ja 0x40660b
lea ecx, [ebp - 0x2c]
call fcn.00402410
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4065f3
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4065e8
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.004025b3
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.004216c9
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.004017e7
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4065b6
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402de4
push esi
call fcn.00402de4
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x406614
push esi
call fcn.00402de4
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406712
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [ecx + 5], bl
push esi
je 0x406734
cmp byte [ecx + 6], bl
je 0x406734
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 4], ecx
jmp 0x406774
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406758
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406758
xor al, al
jmp 0x406776
push 1
push ebx
push ebx
push dword [ebp - 4]
call fcn.0045f500
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
pop ebx
leave
ret 4
Function at 0x4088f6
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x45fef4
call fcn.0045f4a0
sub esp, 0x84
push ebx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi]
cmp eax, esi
je 0x408922
push eax
call ebx
test eax, eax
je 0x408922
mov dword [edi], esi
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.00402472
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], esi
call fcn.00408a09
push 0x20
mov edx, eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004089ee
push dword [ebp + 0xc]
mov edx, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00402378
push dword [ebp - 0x40]
call fcn.00402de4
push dword [ebp - 0x4c]
call fcn.00402de4
push dword [ebp - 0x24]
call fcn.00402de4
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x90], 0x44
mov dword [ebp - 0x8c], esi
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x88], esi
push dword [ebp + 0x10]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x64], esi
mov word [ebp - 0x5e], si
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x5c], esi
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4089c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4089d2
push dword [ebp - 0x30]
call ebx
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
push dword [ebp - 0x18]
call fcn.00402de4
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x409384
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
push 0x2001f
mov dword [ebp - 0xc], ecx
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
push dword [ecx]
lea ecx, [ebp - 4]
call fcn.00409329
cmp eax, esi
jne 0x40941b
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 8], 0x105
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x409408
lea eax, [ebp - 0x220]
lea ecx, [ebp - 4]
push eax
call fcn.00409384
cmp eax, esi
jne 0x40941b
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x105
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 4]
jmp 0x4093d0
lea ecx, [ebp - 4]
call fcn.0040935e
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
call fcn.00409375
lea ecx, [ebp - 4]
mov esi, eax
call fcn.0040935e
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x40946c
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x409496
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc
Function at 0x413698
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x460b96
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.00413747
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040d735
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4136a4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x460b96
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.00413747
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040d735
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414b46
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x460d5a
call fcn.0045f4a0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00402410
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.004148b9
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4156d4
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x460de9
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.00401d3a
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00401d3a
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00401d3a
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00401d3a
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x417f62
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4611d6
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x10]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.00402547
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.0041817e
mov eax, dword [esi + 0x28]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
lea eax, [esi + 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0041810f
mov eax, dword [esi + 0x40]
add esi, 0x48
mov dword [ebx + 0x40], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x48]
mov dword [ebx + 0x44], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x417ffb
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x461209
call fcn.0045f4a0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004180d9
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00401d96
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00401d96
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00401d96
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00401d96
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4