joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45980c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x459876
mov eax, ebx
call fcn.0045bbd0
test al, al
jne 0x459876
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404940
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x459863
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x459883
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048a4
jmp 0x459883
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048a4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45acf4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45ad62
mov eax, esi
call fcn.00443a20
test al, al
je 0x45ad62
mov eax, dword [ebx + 0x84]
call fcn.004436ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45ad62
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45ad56
push 0
mov eax, dword [ebx + 0x84]
call fcn.004436ac
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043b528
jmp 0x45ad62
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045ab30
pop esi
pop ebx
ret
Function at 0x401400
Capabilities:
Create directory

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov edx, ecx
mov ecx, 0x40
cmp edx, 0xff
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
jle 0x40143e
mov dword [esp + 0x10], 0xff
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test eax, eax
jle 0x4014cd
lea ecx, [esp + 0x1c]
lea edi, [esp + 0x1d]
lea ebx, [esp + 0x1e]
sub ecx, esi
lea ebp, [esp + 0x1f]
sub edi, esi
sub ebx, esi
mov dword [esp + 0x14], ecx
sub ebp, esi
mov al, byte [esi]
cmp al, 0x5c
je 0x401479
cmp al, 0x2f
je 0x401479
mov byte [ecx + esi], al
jmp 0x4014bb
mov byte [ecx + esi], 0x5c
lea eax, [esp + 0x1c]
mov byte [edi + esi], 0x2a
mov byte [ebx + esi], 0x2e
push eax
mov byte [esi + ebp], 0x2a
call fcn.004013c0
add esp, 4
mov byte [edi + esi], 0
test al, al
mov byte [ebx + esi], 0
mov byte [esi + ebp], 0
jne 0x4014b7
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4014cd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc eax
inc esi
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x40146a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x4014e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x200
lea eax, [esp]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x25
push 0x25
push str._cProgramFiles_c
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x104]
lea edx, [esp + 4]
push pe_nt_image_headers32
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 0x208]
lea ecx, [esp + 0x104]
push eax
push ecx
lea edx, [esp + 0xc]
push str._sNetblade_s_
push edx
call esi
lea eax, [esp + 0x14]
push eax
call fcn.00401400
mov edx, dword [esp + 0x220]
lea ecx, [esp + 0x18]
push ecx
push 0x431080
push edx
call esi
add esp, 0x20
pop esi
add esp, 0x200
ret
Function at 0x401560
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x264
push ebx
push ebp
push esi
mov esi, dword [esp + 0x278]
cmp esi, 3
push edi
jle 0x4016c1
mov ebx, dword [esp + 0x278]
xor edx, edx
xor eax, eax
mov dl, byte [ebx + 1]
mov al, byte [ebx + 2]
shl edx, 8
add edx, eax
lea ebp, [edx + 3]
cmp esi, ebp
jl 0x4016c1
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
cmp edx, 0x40
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x40
jg 0x4015b5
mov ecx, edx
mov edx, ecx
lea esi, [ebx + 3]
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x27c]
lea esi, [ebp + 2]
cmp edi, esi
jle 0x4016c1
xor edx, edx
xor eax, eax
mov dl, byte [ebx + ebp]
mov al, byte [ebx + ebp + 1]
shl edx, 8
add edx, eax
lea ebp, [edx + esi]
cmp edi, ebp
jl 0x4016c1
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
cmp edx, 0x20
rep stosd dword es:[edi], eax
mov ecx, 0x20
jg 0x401610
mov ecx, edx
mov edx, ecx
add esi, ebx
lea edi, [esp + 0x10]
lea eax, [esp + 0x174]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
call fcn.004014e0
lea edx, [esp + 0x18]
lea eax, [esp + 0x17c]
push edx
push eax
lea ecx, [esp + 0x84]
push 0x4310b0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x8c]
push edx
call fcn.004013c0
add esp, 0x1c
test al, al
jne 0x4016c1
mov eax, dword [esp + 0x27c]
lea edi, [ebp + 2]
cmp eax, edi
jle 0x4016c1
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + ebp]
mov dl, byte [ebx + ebp + 1]
mov esi, ecx
shl esi, 8
add esi, edx
lea ecx, [esi + edi]
cmp eax, ecx
jl 0x4016c1
lea edx, [esp + 0x74]
push 0x4310ac
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4016c1
push ebp
push esi
add edi, ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x264
ret
Function at 0x4022e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x40232d
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x40232d
pop edi
xor ax, ax
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
dec eax
je 0x4023a0
dec eax
jne 0x4023ca
mov eax, dword [esp + 0xc]
cmp eax, 4
jbe 0x4023ca
cmp eax, 5
jne 0x402386
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x402362
pop edi
mov ax, 5
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x402374
pop edi
mov ax, 0x105
pop esi
add esp, 0x9c
ret
cmp eax, 2
jne 0x402367
pop edi
mov ax, 0x205
pop esi
add esp, 0x9c
ret
cmp eax, 6
jne 0x402367
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x402367
pop edi
mov ax, 6
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 4
jne 0x4023ca
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4023ca
cmp eax, 0xa
jne 0x4023c1
pop edi
mov ax, 0xa04
pop esi
add esp, 0x9c
ret
cmp eax, 0x5a
mov ax, 0x5a04
je 0x4023ce
mov ax, 4
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x4023e0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push edi
mov edi, dword [esp + 0x14]
push eax
push 0x4310f8
push 1
push 0
push 0x4310e8
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x402440
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jne 0x402440
mov eax, dword [esp + 8]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x40244e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40245c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x4034e0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x1c]
sub esp, 0x554
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x4034ff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x554
ret
mov ebp, dword [esp + 0x578]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ax, word [esp + 0x57c]
mov edi, ebp
mov word [esp + 0x50], ax
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
je 0x403542
mov esi, ebp
mov edi, dword [esp + 0x574]
mov ebx, dword [esp + 0x570]
push edi
push ebx
lea ecx, [esp + 0x16c]
push 0x431678
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x164]
push edx
push eax
push esi
push 0
push 0x230
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4036b4
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x18]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x64]
push ecx
push edx
call fcn.00402c80
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4035f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea ecx, [esp + 0x68]
push str..exe
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x403646
lea edx, [esp + 0x64]
push str..bat
push edx
call esi
add esp, 8
test eax, eax
jne 0x403646
lea eax, [esp + 0x64]
push str..cmd
push eax
call esi
add esp, 8
test eax, eax
jne 0x403646
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
cmp byte [esp + 0x65], 0x3a
jne 0x403652
mov byte [esp + 0x64], 0x63
lea ecx, [esp + 0x64]
push str.debug
push ecx
call esi
add esp, 8
test eax, eax
jne 0x403686
lea edx, [esp + 0x64]
push str.player.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x403686
lea eax, [esp + 0x64]
push 0x1b
push eax
push str._s_c
jmp 0x403692
lea ecx, [esp + 0x64]
push 0x1b
push ecx
push 0x431394
push 0x433bcc
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [0x433e5c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
mov edx, dword [esp + 0x57c]
mov eax, dword [esp + 0x56c]
mov ecx, dword [esp + 0x568]
push edx
push ebp
push edi
push ebx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x20
pop edi
cmp edx, eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x554
ret
Function at 0x4063d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
push ecx
mov byte [eax], bl
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
jne 0x40643c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x406533
push 0x433ae8
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
xor esi, esi
movsx eax, word [edi + 0xa]
cmp esi, eax
jge 0x4064ab
mov ecx, dword [edi + 0xc]
xor eax, eax
mov edx, dword [ecx + ebx*4]
lea ecx, [ebp - 0x24]
mov al, byte [edx + esi]
push eax
push 0x431be0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
lea ecx, [ebp + 8]
push edx
push eax
push ecx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
inc esi
jmp 0x406458
mov edx, dword [ebp - 0x14]
mov eax, dword [edx - 8]
cmp eax, 4
jle 0x406527
dec eax
push 0x3a
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::SetAt
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push eax
push 0x431bdc
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push edx
push eax
push ecx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [esi + eax]
push 0x431080
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [ebp - 0x14]
add esp, 0xc
add esi, dword [edx - 8]
mov dword [ebp - 0x18], esi
inc ebx
jmp 0x40643c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406880
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x428050
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 8]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x4068f9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x4068f9
mov edx, dword [esp + 0x28]
push 0x431848
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40692c
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push ebp
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x406b10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xc]
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [esp + 0x110]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x408690
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
lea eax, [esp + 0xc]
push esi
xor ebx, ebx
push eax
push 0xf003f
push ebx
mov ebp, ecx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40872c
lea ecx, [ebp + 0xf0a]
lea esi, [ebp + 0xa00]
push edi
mov dword [esp + 0x10], ecx
add ebp, 0x2314
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40871c
mov edx, dword [ebp]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push edx
push eax
push 3
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
inc ebx
add ebp, 4
add edx, 0x201
add esi, 0x81
cmp ebx, 0xa
mov dword [esp + 0x10], edx
jl 0x4086d8
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x18]
pop edi
mov eax, dword [ebp + 0x9d4]
mov ecx, dword [ebp + 0x9d0]
lea esi, [ebp + 0x9d0]
cmp eax, ecx
je 0x408795
mov eax, dword [ebp + 0x9d8]
test eax, eax
jne 0x408795
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408795
mov edx, dword [esp + 0xc]
push 4
push esi
push 4
push eax
push str.SyncMode5
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x40b3c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x28
call sub.MFC42.DLL_operatornew
mov esi, eax
mov ecx, 0xa
xor eax, eax
mov edi, esi
add esp, 4
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esi + 8]
push 0x431080
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push esi
push 0
push 0x40b070
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0x18
pop edi
pop esi
ret 4

Function at 0x40e0f0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4287f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x14], edi
call fcn.0040d940
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x40e140
mov al, byte [esp + 0xb]
lea ecx, [esp + 0xb]
push 0x42cf30
push ecx
mov byte [esp + 0x13], al
call sub.MSVCRT.dll__CxxThrowException
lea edx, [esp + 0xc]
push edx
push 4
push esi
push 0x40de30
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jne 0x40e181
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x42ce20
push edx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [esi + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x40e1a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x42ce20
push edx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40e1d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x42ce20
push ecx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, edi
mov dword [esi + 0x1c], 1
call fcn.0040d950
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x40e780
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e7b8
cmp dword [esp + 0x10], 4
setne al
pop ecx
ret
mov eax, 2
pop ecx
ret

Function at 0x40e7c0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret
Function at 0x40e7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x18], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e818
cmp dword [esp + 0x10], 1
setne al
pop ecx
ret
mov eax, 2
pop ecx
ret

Function at 0x40e820
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
ret

Function at 0x410340
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x411210
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x490
lea eax, [esp + 0x34]
push edi
push eax
call fcn.00410340
add esp, 4
lea ecx, [esp + 4]
push 0x433ae8
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x498]
push 0x4310a8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x41139a
push ebx
push esi
push 2
push 0
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push edi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_rewind]
add esp, 0x14
test ebx, ebx
jbe 0x4112ac
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 0x400
lea edx, [esp + 0xa4]
push 1
push edx
call ebp
mov esi, eax
lea eax, [esp + 0xac]
push esi
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.00410370
add esp, 0x1c
sub ebx, esi
jne 0x41127d
pop ebp
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00410dc0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
lea ecx, [esp + 0xc]
push 0x433ae8
call sub.MFC42.DLL_CString::operator_2
xor edi, edi
xor ecx, ecx
mov cl, byte [esp + edi + 0x20]
mov esi, ecx
mov eax, esi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp eax, 9
jle 0x41130f
add al, 0x37
lea edx, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
jmp 0x41132f
add al, 0x30
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
mov eax, esi
and eax, reloc.WS2_32.dll_ntohs
jns 0x411342
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 9
jle 0x411369
add al, 0x37
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push ecx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
jmp 0x411389
add al, 0x30
lea edx, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
inc edi
cmp edi, 0x10
jl 0x4112d5
pop esi
pop ebx
lea ecx, [esp + 8]
push 0x20
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Left
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x49c]
push edx
push 0x431080
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
pop edi
add esp, 0x490
ret