joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x426e76
jl 0x426e6a
test esi, esi
jne 0x426e76
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x426e8f
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov ecx, dword [eax]
test ecx, ecx
je 0x426ea2
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
jmp 0x426ea4
xor eax, eax
mov dword [ebp - 4], esi
test eax, eax
je 0x426ed7
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push ecx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp + 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
jmp 0x426edd
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ebx + 0x4c], 0
je 0x426f8c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x426f08
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp + 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x426f4f
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp + 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp + 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x426f79
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x426f20
cmp dword [ebp - 4], 0
jbe 0x426f8f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x426fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x426fd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x426ff6
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x426ff8
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x427076
jg 0x42700b
test esi, esi
je 0x427076
test ecx, ecx
jl 0x42704f
jg 0x427015
test eax, eax
je 0x42704f
cmp edi, ecx
jg 0x427027
jl 0x42701f
cmp esi, eax
jae 0x427027
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x427052
mov edx, dword [ebp + 8]
test edi, edi
jl 0x427076
jg 0x42705c
test esi, esi
je 0x427076
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x427076
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434618
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x446054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov eax, esi
mov dword [ebp - 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x42823c
mov eax, dword [esi]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0x20119
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4282a5
push dword [ebp - 0x10]
call ebx
cmp dword [esi + 0x14], 8
jb 0x428269
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x20219
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4282a5
push dword [ebp - 0x10]
call ebx
push dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
call fcn.00402b60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x800
mov dword [ebp - 0x14], 0
mov dword [ebp + 0x10], 0x400
call fcn.0042d5c2
mov edi, eax
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp + 0x10]
add ecx, ecx
mov dword [ebp - 4], 0
push ecx
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0x14]
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x4282e5
mov eax, dword [eax]
lea ecx, [ebp + 0x10]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call ebx
test esi, esi
mov esi, dword [ebp + 8]
je 0x428314
push dword [ebp + 0x18]
mov ecx, esi
call fcn.00402b60
jmp 0x428348
mov ecx, edi
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428330
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00402220
test edi, edi
je 0x428355
push edi
call fcn.0042d5cb
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434618
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x446054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov eax, esi
mov dword [ebp - 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4286bc
mov eax, dword [esi]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0x20119
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x428704
push dword [ebp - 0x10]
call ebx
cmp dword [esi + 0x14], 8
jb 0x4286e9
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x20219
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4287ed
mov esi, dword [ebp + 0x14]
mov eax, esi
mov dword [ebp - 0x14], 0
mov dword [ebp + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x42871f
mov eax, dword [esi]
lea ecx, [ebp + 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4287ed
cmp dword [ebp - 0x14], 1
jne 0x4287ed
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4287ed
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d5c2
mov edi, eax
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp + 0x10]
add ecx, ecx
mov dword [ebp - 4], 0
push ecx
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x42878d
mov esi, dword [esi]
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x4287d9
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00401300
test edi, edi
je 0x4287c5
push edi
call fcn.0042d5cb
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4287ed
push edi
call fcn.0042d5cb
add esp, 4
push dword [ebp - 0x10]
call ebx
push dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
call fcn.00402b60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x42883e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428852
test al, 0x10
jne 0x428852
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x100013f0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, dword [edi]
push ebp
mov ebp, dword [esp + 0xc]
test eax, eax
je 0x1000140a
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [edi], 0
cmp ebp, 0x5cc60
jbe 0x10001416
xor al, al
pop ebp
ret
test ebp, ebp
jne 0x1000141e
mov al, 1
pop ebp
ret
push esi
lea esi, [ebp + 3]
shr esi, 2
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x1000145b
mov ecx, dword [esp + 0xc]
push ecx
push ebp
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, ebp
je 0x10001460
pop esi
xor al, al
pop ebp
ret
cmp byte [0x10009891], 0
je 0x10001487
xor eax, eax
test esi, esi
jbe 0x10001487
mov edx, 0xe395a6c7
mov ecx, dword [edi]
xor dword [ecx + eax*4], edx
lea ecx, [ecx + eax*4]
inc eax
sub edx, 0x1c6a5939
cmp eax, esi
jb 0x10001474
pop esi
mov al, 1
pop ebp
ret

Function at 0x100019a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, esi
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100015c2
push eax
push esi
push dword [ebp + 8]
call fcn.10001577
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100015c2
push eax
push esi
push dword [ebp + 8]
call fcn.10001577
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100015b2

Function at 0x10006710
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10006723
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000671f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10006740
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1000677f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10006775
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10006781
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10006765
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4239f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x423a05
pop dword [ebp - 0x4c]
mov eax, 0x423a05
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3bcb1
push 0
mov eax, 0x1c06528a
add eax, 0xe43d2da6
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x14e940d0
sub ecx, 0x14e8f454
xor ebx, ebx
add ebx, eax
mov edi, 0x44c600
add edi, dword [ebp - 0x4c]
mov edx, 0xeca94856
sub edx, 0xfdadd3cb
xor dword [ebp - 0x2c], 0x4b2a177c
mov esi, dword [edi]
sub dword [ebp - 8], 0x9f0ea0ec
add esi, edx
add dword [ebp - 0x1c], 0x4bd241d6
mov dword [ebx], esi
sub dword [ebp - 0x34], edi
add ebx, 0x10a6ca11
add ebx, 0xef5935f3
add edi, 0x32978fc6
sub edi, 0x32978fc2
loop 0x423a5b
add eax, 0x124c3
xor ebx, ebx
add ebx, eax
add eax, 0xd17442b5
add eax, 0x2e8bbd50
mov ecx, 0x5cb7decc
sub ecx, 0x5c77decc
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4281f2
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x436de3
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43a908
mov dword [esi + 4], 0x43a8f4
mov dword [esi + 8], 0x438e70
mov dword [esi + 0xc], 0x43a8d8
mov dword [esi + 0x10], 0x43a8c4
mov dword [esi + 0x14], 0x43a8b4
mov dword [esi + 0x18], 0x438e60
mov dword [esi + 0x1c], 0x438e50
mov dword [esi + 0x20], 0x43a8ac
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004028e9
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x43a880
mov dword [esi + 4], 0x43a86c
mov dword [esi + 8], 0x43a854
mov dword [esi + 0xc], 0x43a838
mov dword [esi + 0x10], 0x43a824
mov dword [esi + 0x14], 0x43a814
mov dword [esi + 0x18], 0x43a804
mov dword [esi + 0x1c], 0x43a7f4
mov dword [esi + 0x20], 0x43a7ec
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x415370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x43c074
push ecx
mov edi, eax
call fcn.004287c8
mov esi, eax
add esp, 8
test esi, esi
jne 0x4153cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0042865e
push esi
call fcn.004285e1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x417920
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x41797e
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x459a78
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x41798a
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00428811
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x41797e
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x459a78
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x4179fa
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.004293a2
xor esi, esi
add esp, 8
cmp eax, esi
je 0x417a27
mov word [eax], si
add eax, 2
push eax
call fcn.00429350
add esp, 4
jmp 0x417a29
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x41797e
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x417980
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x418150
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x41810f
cmp dword [eax + 0xc], ebx
je 0x4181b2
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00417b6a
scasd eax, dword es:[edi]
dec edi
xor dword [eax + 0x750c5d39], ebp
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
jmp 0x418157
call fcn.00417b6a
mov ch, dh
cmp eax, 0x10458bd0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x4181a0
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x41817b
and eax, 0xffff
push eax
jmp 0x41817f
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417b2f
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x418359
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x418160
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x418101
call fcn.00417b6a
invalid
Function at 0x418270
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4182bd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4182a4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4182ad
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4182b7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x418299
inc dword [ebp + 0xc]

Function at 0x4182c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x418241
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41825f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x418223
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x418470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7

Function at 0x41b3e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x41b457
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x41b42e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41b411
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x41b41e
add edx, ecx
cmp ebx, edx
jb 0x41b42a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x41b407
xor ecx, ecx
jmp 0x41b442
test eax, eax
jne 0x41b432
xor ecx, ecx
jmp 0x41b442
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0041b360
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x41b750
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b781
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x41b7a6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x41b7ce
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x41b7f3
push ecx
push esi
call fcn.0041b460
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret