joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001b43a
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001b43a
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4062c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
movzx eax, word [esi + 0x4c]
push eax
call sub.Cef1Adapter.dll_ChannelCreate
add esp, 4
test eax, eax
mov dword [esi + 0x48], eax
je 0x40631e
mov dword [esi + 0x20], esi
add esi, 8
cmp byte [esi + 6], 0
jne 0x40631e
lea ecx, [esi + 0x14]
push ecx
push 0
push esi
push 0x4058c0
push 0
push 0
mov byte [esi + 4], 0
mov byte [esi + 7], 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi + 0xc], eax
je 0x40631e
cmp eax, 0xffffffff
je 0x40631e
cmp byte [esi + 4], 0
mov byte [esi + 6], 1
setne dl
mov byte [esi + 8], dl
pop esi
ret
Function at 0x410670
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push 0x7ff
push 0x7ff
push 0x41b900
call dword [sym.imp.MSVCR80.dll__vsnprintf_s]
add esp, 0x14
push 0x41b900
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret
Function at 0x411f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413249
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x41b01c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov dword [esp + 0x28], 0
mov eax, dword [0x41c100]
mov ecx, dword [sym.imp.MSVCP80.dll_class_std::locale::id_std::ctype_wchar_t_::id]
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov ecx, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::locale::facet_const____thiscall_std::locale::_Getfacet_unsigned_int_const]
mov esi, eax
test esi, esi
jne 0x411fe4
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x411fe4
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCP80.dll_public:_static_unsigned_int___cdecl_std::ctype_wchar_t_::_Getcat_class_std::locale::facet_const___]
add esp, 4
cmp eax, 0xffffffff
jne 0x411fc8
push str.bad_cast
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCR80.dll_public:_void___thiscall_std::bad_cast::constructor_char_const__]
push 0x416960
lea edx, [esp + 0x18]
push edx
call sub.MSVCR80.dll__CxxThrowException
mov ecx, dword [esp + 0xc]
mov esi, ecx
mov dword [0x41c100], ecx
mov edi, ecx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Register_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001e9ed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001ea8a
push ebx
push esi
call fcn.1001e9b6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e8ff
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ea37
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ea89
push edi
push eax
call fcn.1001d4ac
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001ea57
call fcn.1001d112
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ea88
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e8ff
add esp, 0x20
test eax, eax
jne 0x1001ea76
push edi
call fcn.1001d112
jmp 0x1001ea7e
push ebx
call fcn.1001d112
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001ecf5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028fc0
push 0x10028fb8
push str.FlsAlloc
push 0x1e
call fcn.1001ec13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ed29
push dword [ebp + 8]
mov ecx, esi
call dword [0x10026168]
call esi
jmp 0x1001ed2f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001ed73
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028fd0
push 0x10028fc8
push str.FlsGetValue
push 0x20
call fcn.1001ec13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001edaa
push dword [ebp + 8]
mov ecx, esi
call dword [0x10026168]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x46f78c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
mov ecx, dword [0xfacb7c]
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], esi
test ecx, ecx
jle 0x46f960
mov edx, dword [esp + 0x28]
mov eax, dword [esi*4 + 0xfad09c]
cmp dword [eax], edx
je 0x46f7c6
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jl 0x46f7ad
jmp 0x46f960
cmp dword [esp + 0x38], 0x20
jne 0x46f934
mov eax, dword [eax + 8]
mov ebp, dword [esp + 0x44]
test eax, eax
je 0x46f80a
cmp ebp, 0x20
je 0x46f7e6
cmp ebp, 0xffffffff
jne 0x46f80a
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x46f95e
mov eax, dword [esp + 0x2c]
inc eax
imul ebx, eax, 3
and ebx, 0xfffffffc
mov eax, ebx
mov dword [esp + 0x14], ebx
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0xf3329c]
call dword [0xf30ce4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x46f960
mov edi, dword [esp + 0x30]
test edi, edi
jle 0x46f8ff
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ecx
mov ebp, edx
test eax, eax
jle 0x46f8df
mov ebx, ecx
mov esi, eax
mov ecx, 0xff
movzx eax, byte [ebp + 2]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
sub eax, ecx
movzx ecx, byte [ebp - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx], al
lea ebx, [ebx + 3]
dec esi
jne 0x46f870
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebx
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x46f85d
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x44]
mov eax, dword [esi*4 + 0xfad09c]
mov esi, dword [esp + 0x18]
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push ebx
push edi
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0xf3329c]
mov edi, eax
call dword [0xf30ce8]
jmp 0x46f960
cmp dword [esp + 0x38], 0x18
jne 0x46f960
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x28
Function at 0x472cc0
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
push edi
test ecx, ecx
je 0x4742f6
mov edi, dword [ecx + 0x1c]
mov dword [esp + 0x14], edi
test edi, edi
je 0x4742f6
cmp dword [ecx + 0xc], 0
je 0x4742f6
cmp dword [ecx], 0
jne 0x472cf8
cmp dword [ecx + 4], 0
jne 0x4742f6
cmp dword [edi], 0xb
jne 0x472d03
mov dword [edi], 0xc
mov eax, dword [ecx + 0xc]
mov edx, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
xor eax, eax
push ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x38], ebp
push esi
mov esi, dword [edi + 0x3c]
cmp eax, 0x1e
ja 0x473675
lea ebx, [edi + 0x54]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
jmp 0x472d50
jmp dword [eax*4 + 0x474300]
pop esi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
Function at 0x4ab6c7
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4ab77d
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4ab75d
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x4ab738
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4ab772
add edi, dword [esp + 0x14]
jmp 0x4ab776
add edi, dword [esp + 0x24]
test edx, edx
jne 0x4ab716
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x4aba88
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x4abb62
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x4abb38
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x4abb00
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x4abb4f
add edi, ecx
jmp 0x4abb53
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x4abad6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x4ac182
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x4ac237
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4ac218
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x4ac1f3
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x4ac22d
add edx, dword [esp + 0x14]
jmp 0x4ac231
add edx, dword [esp + 0x24]
test esi, esi
jne 0x4ac1d1
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10029ea1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x10029ea1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10029eb0
pop dword [ebp - 0x28]
mov eax, 0x6b44be53
add eax, 0xa4bde05d
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4076a
push 0
mov eax, 0x56c8d3be
add eax, 0xb93a1d9e
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x48f4
mov ebx, eax
mov edx, 0x20ff5c6c
sub edx, 0x10fab06c
add edx, dword [ebp - 0x28]
mov edi, 0xecaf1db3
add edi, 0x636ecf32
xor dword [ebp - 0xc], 0x47d12022
mov esi, dword [edx]
add dword [ebp - 0x1c], 0x9166cab7
sub esi, edi
sub dword [ebp - 0x24], edx
mov dword [ebx], esi
add dword [ebp - 0x1c], ebx
add ebx, 0xa92c1276
sub ebx, 0xa92c1272
add edx, 0x145a026a
add edx, 0xeba5fd9a
loop 0x10029f09
add eax, 0x8edb4876
sub eax, 0x8eda31d3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6dd69746
sub ecx, 0x5dd69746
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4014b9
Capabilities:
Delete registry value

Disassembly:
push ebx
sub esp, 0x38
mov ebx, ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4014f4
mov eax, 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 8
test eax, eax
je 0x401521
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
jmp 0x4014ef
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 1
jmp 0x4014ef

Function at 0x401537
Capabilities:
Set registry value

Disassembly:
push edi
push ebx
sub esp, 0x44
mov ebx, ecx
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
je 0x401594
mov eax, 0
add esp, 0x44
pop ebx
pop edi
ret
mov ecx, 0xffffffff
mov edi, dword [esp + 0x50]
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
je 0x4015ea
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
jmp 0x40158e
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 1
jmp 0x40158e

Function at 0x401600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x38
mov ebx, ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x40168d
mov dword [esp + 0x28], 0x104
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x408020
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x401677
cmp dword [esp + 0x24], 1
je 0x401694
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
jmp 0x4016a8
mov eax, 0
jmp 0x4016a8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0x408020
add esp, 0x38
pop ebx
ret
Function at 0x401eef
Capabilities:
Hide graphical window

Disassembly:
push esi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x50]
mov dword [0x40819c], eax
call sub.COMCTL32.DLL_InitCommonControls
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4016ad
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [0x40819c]
mov dword [esp], eax
call sub.USER32.dll_CreateDialogParamA
sub esp, 0x14
mov esi, eax
lea ebx, [esp + 0x24]
jmp 0x401f6a
cmp dword [esp + 0x2c], 0x1b
jne 0x401f9b
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.USER32.dll_ShowWindow
sub esp, 8
call fcn.00401460
jmp 0x401f9b
mov dword [esp], esi
call sub.USER32.dll_IsWindow
sub esp, 4
test eax, eax
je 0x401fcb
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x401fcb
cmp dword [esp + 0x28], 0x100
je 0x401f3a
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.USER32.dll_IsDialogMessageA
sub esp, 8
test eax, eax
jne 0x401f5b
mov dword [esp], ebx
call sub.USER32.dll_TranslateMessage
sub esp, 4
mov dword [esp], ebx
call sub.USER32.dll_DispatchMessageA
sub esp, 4
call fcn.00401460
jmp 0x401f5b
mov eax, 1
add esp, 0x44
pop ebx
pop esi
ret 0x10
Function at 0x402770
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4081c4
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x4081bc]
sub esp, 4
test ebx, ebx
je 0x4027bb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4027b4
test esi, esi
je 0x4027b4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402790
mov dword [esp], 0x4081c4
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4029a0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4029f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402ac8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402a2e
cmp eax, 4
jne 0x402a50
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402a3e
cmp edx, 4
je 0x402a3e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004029a0
Function at 0x404830
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00402660
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x404866
jmp 0x40489e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404863
cmp al, 9
je 0x404863
cmp al, 0x22
jne 0x404887
jmp 0x4048e6
cmp al, 9
je 0x404893
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x404880
jmp 0x404893
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404890
cmp al, 9
je 0x404890
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x4048ad
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401eef
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x4048f2
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x4048e2
cmp al, 0x22
jne 0x404893
lea ebx, [edx + 2]
jmp 0x404893