joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d3f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43f027
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov ecx, dword [esp + 0x28]
push esi
mov esi, dword [0x44a1b0]
xor eax, eax
cmp ecx, esi
mov dword [esp + 4], eax
jbe 0x40d436
push eax
push str.Error
push str.A_file_exceeds_the_size_of_the_target_media
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 4
call fcn.00433453
push edi
mov edi, dword [0x44a1b4]
mov edx, esi
sub edx, edi
cmp edx, ecx
ja 0x40d45b
push ebx
mov edx, 0x44a1b4
mov ebx, dword [edx + 4]
add edx, 4
mov edi, esi
inc eax
sub edi, ebx
cmp edi, ecx
jbe 0x40d44b
pop ebx
mov esi, dword [eax*4 + 0x44a1b4]
add esi, ecx
mov dword [eax*4 + 0x44a1b4], esi
inc eax
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0041722c
add esp, 8
mov esi, eax
push str.DISK
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.00416cb2
push esi
mov esi, dword [esp + 0x30]
push esi
mov ecx, eax
mov byte [esp + 0x2c], 2
call fcn.00416f5d
mov dword [esp + 8], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00416d10
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.00416d10
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x40df60
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43f1a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push str.Unrecognised_registry_format____n_File:
lea ecx, [esp + 8]
call fcn.00416cb2
mov eax, dword [esp + 0x24]
xor ebx, ebx
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x20], ebx
call fcn.00416e70
push str._nLine:
lea ecx, [esp + 0x10]
call fcn.00416cb2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
push ecx
lea ecx, [esp + 8]
call fcn.00416e70
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.00416d10
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push edx
call fcn.00416cb2
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x20], 2
call fcn.00416e70
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.00416d10
push str._nLine_:
lea ecx, [esp + 0x10]
call fcn.00416cb2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 3
push ecx
lea ecx, [esp + 8]
call fcn.00416e70
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.00416d10
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.0041722c
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call fcn.00416e70
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.00416d10
lea ecx, [esp + 4]
push ebx
push ecx
call fcn.00407480
add esp, 8
push 4
call fcn.00433453
pop ebx
nop
nop
nop
nop
nop
nop
nop
Function at 0x40f780
Capabilities:
Create process on windows
Persist via run registry key
Terminate process

Disassembly:
mov eax, 0x1458
call fcn.00433d80
lea eax, [esp + 0x458]
push 0x1000
push eax
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTBUPDD
push 0x80000002
call fcn.0040bc10
add esp, 0x14
test al, al
je 0x40f92e
lea ecx, [esp + 0x58]
push 0x400
push ecx
push str.Customisation
push 0
call fcn.00413c6a
lea edx, [esp + 0x58]
push str.EganPPT
push edx
call fcn.0043302b
add esp, 8
test eax, eax
je 0x40f83d
lea eax, [esp + 0x58]
push str.EganPPT2
push eax
call fcn.0043302b
add esp, 8
test eax, eax
je 0x40f83d
lea ecx, [esp + 0x58]
push str.Egan
push ecx
call fcn.0043302b
add esp, 8
test eax, eax
jne 0x40f82f
mov eax, dword [0x454358]
lea edx, [esp + 0x58]
push 0x400
push edx
push 0x13
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 4
push str.Teamboard_Install
jmp 0x40f85c
push 4
push 6
call fcn.00407620
add esp, 8
jmp 0x40f869
mov eax, dword [0x454358]
lea edx, [esp + 0x58]
push 0x400
push edx
push 0x13
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 4
push 0x44c140
lea ecx, [esp + 0x60]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
cmp eax, 6
push edi
jne 0x40f925
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0x200
push 0
push 0
lea edx, [esp + 0x47c]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40f925
call fcn.00418537
test eax, eax
je 0x40f925
mov eax, dword [esp + 0x14]
push eax
push 1
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push 0x1f4
push edi
call esi
cmp eax, 0x102
jne 0x40f925
lea ecx, [esp + 8]
push ecx
push str.IsV2CleanupNeeded
push 0
call fcn.00413d19
mov eax, dword [esp + 8]
test eax, eax
jne 0x40f90a
call fcn.00408250
push 1
push str.IsV2CleanupNeeded
push 0
call fcn.00413e16
push str.upddtidy
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.0041695e
call fcn.00413b01
jmp 0x40f8cf
push 4
call fcn.00433453
pop edi
pop esi
add esp, 0x1458
ret
Function at 0x4139b5
Capabilities:
Print debug messages

Disassembly:
call fcn.00416a78
test eax, eax
je 0x4139c3
jmp 0x4195ac
push ebx
push esi
mov esi, 0x4548d0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x44cebc], 1
call fcn.00419379
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
je 0x413a17
call fcn.004193c5
cmp dword [0x4548ec], 0
je 0x413a12
cmp dword [0x4548f0], 1
jl 0x413a08
push str.TBApiTerminate___Waiting_for_FlushPendingRequests_to_complete_n
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4139ef
call fcn.00419386
cmp dword [0x4548f0], 1
jl 0x413a27
push str.TBApiTerminate___Complete_n
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret
push edi
mov dword [0x44f9c4], 1
call fcn.0041b176
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
je 0x4195f3
call fcn.0041b1e4
cmp dword [0x45c6d8], 0
je 0x4195ee
cmp dword [0x45c6dc], 1
jl 0x4195e4
push str.V2TBApiTerminate___Waiting_for_FlushPendingRequests_to_complete_n
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4195cb
call fcn.0041b183
cmp dword [0x45c6dc], 1
jl 0x419603
push str.V2TBApiTerminate___Complete_n
call edi
pop edi
ret
Function at 0x415d10
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov eax, 0x43fae8
call fcn.00434b78
sub esp, 0x46c
push ebx
push esi
push edi
lea eax, [ebp - 0x374]
push dword [ebp + 8]
push eax
call fcn.00434ba0
lea eax, [ebp - 0x374]
push 0x44dd30
push eax
call fcn.00434bb0
push dword [ebp + 8]
lea eax, [ebp - 0x270]
push eax
call fcn.00434ba0
lea eax, [ebp - 0x270]
push str.inst16.dun
push eax
call fcn.00434bb0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x20
lea eax, [ebp - 0x270]
push eax
call edi
mov esi, 0x104
lea eax, [ebp - 0x478]
push esi
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x16c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x16c]
push str.command.com__c
push eax
call fcn.00434bb0
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.00434bb0
mov esi, 0x44c204
lea eax, [ebp - 0x16c]
push esi
push eax
call fcn.00434bb0
push dword [ebp + 0xc]
lea eax, [ebp - 0x16c]
push eax
call fcn.00434bb0
lea eax, [ebp - 0x16c]
push esi
push eax
call fcn.00434bb0
push dword [ebp + 0x10]
lea eax, [ebp - 0x16c]
push eax
call fcn.00434bb0
lea eax, [ebp - 0x16c]
push esi
push eax
call fcn.00434bb0
push dword [ebp + 0x14]
lea eax, [ebp - 0x16c]
push eax
call fcn.00434bb0
add esp, 0x40
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [ebp - 0x24]
xor esi, esi
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x3c], 1
push dword [ebp + 8]
mov word [ebp - 0x38], si
push esi
push 0x200
push esi
push esi
lea eax, [ebp - 0x16c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x14]
push eax
call fcn.00416cb2
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
call fcn.00415ec0
mov bl, al
pop ecx
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
inc bl
call fcn.00416d10
test bl, bl
je 0x415ea6
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x14]
push eax
call fcn.00416cb2
jmp 0x415e65
lea eax, [ebp - 0x270]
push eax
call edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x415ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [esp + 4]
call fcn.00416d31
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret
Function at 0x415fe4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
call fcn.00418537
test eax, eax
je 0x41605e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x416068
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x416027
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0
mov dword [ebp - 0x14], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x416068
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
leave
ret
Function at 0x4169cb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x44ceec]
test eax, eax
jge 0x416a19
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x416a10
cmp dword [ebp - 0x90], 5
jne 0x416a10
push 1
pop eax
mov dword [0x44ceec], eax
leave
ret
and dword [0x44ceec], 0
xor eax, eax
leave
ret

Function at 0x416a1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416a3e
xor al, al
leave
ret
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push dword [ebp + 0x14]
mov dword [ebp - 4], 1
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
leave
ret
Function at 0x4181e9
Capabilities:
Set registry value

Disassembly:
mov eax, 0x43ff78
call fcn.00434b78
sub esp, 0x18
push ebx
lea ecx, [ebp - 0x1c]
push dword [ebp + 0xc]
call fcn.00416cf8
xor ebx, ebx
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 4], ebx
je 0x41821f
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041840f
add esp, 0xc
lea eax, [ebp - 0x24]
push 6
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041707b
push str.TBUPDD
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00417020
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00416d10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
call fcn.00416d31
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x41829e
push esi
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push ebx
call fcn.00416d31
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
jne 0x41829e
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00416d10
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4182b9
Capabilities:
Set registry value

Disassembly:
mov eax, 0x43ff8c
call fcn.00434b78
sub esp, 0x10
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 0xc]
call fcn.00416cf8
xor esi, esi
cmp dword [ebp + 0x18], esi
mov dword [ebp - 4], esi
je 0x4182ef
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041840f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
call fcn.00416d31
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x418345
mov ecx, dword [ebp + 0x10]
push edi
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push esi
call fcn.00416d31
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x418345
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00416d10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x418360
Capabilities:
Set registry value

Disassembly:
mov eax, 0x43ffa0
call fcn.00434b78
sub esp, 0x10
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 0xc]
call fcn.00416cf8
xor esi, esi
cmp dword [ebp + 0x18], esi
mov dword [ebp - 4], esi
je 0x418396
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041840f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
call fcn.00416d31
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x4183f4
push edi
push dword [ebp + 0x14]
call fcn.004347c0
pop ecx
inc eax
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push 1
push esi
call fcn.00416d31
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x4183f4
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00416d10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41848f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x44e98c]
test eax, eax
jge 0x4184dd
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x4184d4
cmp dword [ebp - 0x90], 5
jne 0x4184d4
push 1
pop eax
mov dword [0x44e98c], eax
leave
ret
and dword [0x44e98c], 0
xor eax, eax
leave
ret

Function at 0x4184df
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x44e990]
test eax, eax
jge 0x418535
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x41852c
cmp dword [ebp - 0x90], 5
jne 0x41852c
push 1
pop eax
cmp dword [ebp - 0x8c], eax
jne 0x41852c
mov dword [0x44e990], eax
leave
ret
and dword [0x44e990], 0
xor eax, eax
leave
ret

Function at 0x418565
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 1
pop eax
cmp dword [ebp - 0x84], eax
jne 0x4185a2
cmp dword [ebp - 0x8c], 0xa
je 0x4185a4
cmp dword [ebp - 0x8c], 0x5a
je 0x4185a4
xor eax, eax
leave
ret

Function at 0x4187ec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x418817
call fcn.00417bc9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret
Function at 0x4188ad
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41891f
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x41890a
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.004188ad
pop ecx
pop ecx
jmp 0x4188d3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
leave
ret

Function at 0x41982d
Capabilities:
Print debug messages

Disassembly:
push esi
push dword [esp + 8]
call fcn.004347c0
add eax, 0x20
push eax
call fcn.004340d2
pop ecx
mov esi, eax
pop ecx
push dword [esp + 0xc]
push dword [esp + 0xc]
push esi
call fcn.004330da
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00433020
pop ecx
pop esi
ret

Function at 0x41b800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44037b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x20]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call fcn.0041d570
lea ebp, [esi + 0x48]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebp
mov dword [ebp + 8], ebx
push 0x45c738
mov byte [esp + 0x24], 1
call fcn.0041bbf0
add esp, 4
mov byte [esp + 0x20], 2
mov eax, dword [0x45c6f8]
cmp eax, ebx
je 0x41b899
mov ecx, dword [eax]
mov dword [0x45c6f8], ecx
jmp 0x41b8f4
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x14
push edx
push 8
call fcn.0041c030
mov ecx, eax
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 1
mov dword [esp + 0x10], ecx
jne 0x41b8c3
mov eax, ecx
jmp 0x41b8f4
add ecx, 8
push edi
mov dword [0x45c6f8], ecx
mov edx, ecx
add ecx, 8
mov edi, 1
dec eax
cmp eax, edi
je 0x41b8ed
mov dword [edx], ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
inc edi
add ecx, 8
dec eax
cmp eax, edi
jne 0x41b8dc
mov eax, dword [esp + 0x14]
mov dword [edx], ebx
pop edi
mov dword [0x45c738], ebx
lea ecx, [eax + 8]
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], ecx
mov ecx, dword [esp + 0x18]
mov byte [eax], bl
mov dword [esi], vtable._STL::ios_base.0
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41b950
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4403b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], vtable._STL::ios_base.0
push 0
mov dword [esp + 0x1c], 1
call fcn.0041b6a0
mov eax, dword [esi + 0x24]
push eax
call fcn.00433a1c
mov ecx, dword [esi + 0x30]
push ecx
call fcn.00433a1c
mov edx, dword [esi + 0x38]
push edx
call fcn.00433a1c
lea eax, [esi + 0x48]
add esp, 0xc
mov dword [esp + 0xc], eax
mov edi, dword [eax]
mov eax, dword [eax + 8]
sub eax, edi
mov byte [esp + 0x18], 2
test edi, edi
je 0x41b9f3
cmp eax, 0x80
jbe 0x41b9cc
push edi
call fcn.00433020
add esp, 4
jmp 0x41b9f3
dec eax
push ebx
shr eax, 3
mov ecx, 0x45c738
lea ebx, [eax*4 + 0x45c6f8]
call fcn.0041ba30
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [ebx], edi
mov ecx, 0x45c738
call fcn.0041bb20
pop ebx
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041d5c0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41c1c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x41c1f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41c1ec
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
add esp, 8
ret

Function at 0x41c200
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0xffffffff
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
cmp dword [0x44fbe8], ebx
jne 0x41c235
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0xc]
mov dword [0x44fbe8], ecx
mov dword [esi + 4], ebx
mov eax, dword [0x44fbe8]
cmp eax, ebx
ja 0x41c24b
mov dword [0x44fbe8], 0x1000
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x41c520
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1020
call fcn.00433d80
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
test byte [edi + 8], 1
je 0x41c545
push 4
push 0
mov ecx, edi
call fcn.0041c6e0
test byte [edi + 8], 4
je 0x41c574
mov esi, dword [esp + 0x1038]
mov ecx, dword [esp + 0x1034]
mov edx, dword [edi]
lea eax, [esp + 0x20]
push 0
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [esp + 0x20]
jmp 0x41c698
mov ebx, dword [esp + 0x1034]
mov eax, dword [esp + 0x1038]
cmp eax, 0x1000
lea ebp, [esp + 0x2c]
lea ecx, [ebx + eax]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x10]
jg 0x41c5a7
lea eax, [esp + 0x1038]
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x10], esi
jle 0x41c658
jmp 0x41c5bb
mov esi, dword [esp + 0x10]
push esi
push 0xa
push ebx
call fcn.00435bd0
add esp, 0xc
test eax, eax
je 0x41c634
sub eax, ebx
mov esi, ebx
mov ecx, eax
mov edi, ebp
mov edx, ecx
add ebp, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea ebx, [ebx + eax + 1]
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov byte [ebp - 1], 0xd
mov byte [ebp], 0xa
inc ebp
lea eax, [esp + 0x102c]
sub ecx, ebx
sub eax, ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
test eax, eax
lea eax, [esp + 0x10]
jg 0x41c61c
lea eax, [esp + 0x28]
cmp dword [eax], ecx
jl 0x41c624
lea eax, [esp + 0x1c]
mov eax, dword [eax]
mov edi, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], eax
jg 0x41c5b7
jmp 0x41c658
test esi, esi
jle 0x41c658
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
add ebx, eax
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x2c]
sub ebp, ecx
je 0x41c688
mov eax, dword [edi]
lea edx, [esp + 0x24]
push 0
push edx
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x41c688
test eax, eax
je 0x41c6d1
add esi, eax
sub ebp, eax
jne 0x41c664
mov eax, dword [esp + 0x1034]
mov esi, dword [esp + 0x1038]
sub ebx, eax
cmp esi, ebx
je 0x41c6c2
test ebx, ebx
jle 0x41c6d1
cmp ebx, esi
jge 0x41c6d1
mov eax, dword [esp + 0x1034]
sub esi, ebx
add eax, ebx
mov dword [esp + 0x1038], esi
mov dword [esp + 0x1034], eax
jmp 0x41c534
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1020
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1020
ret 8