joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486ac0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x486ae6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x486b1e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.004485d0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x486b75
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x486b84
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x486b95
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x4877d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x48781c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x4877e1
pop ebx
pop edi
pop esi
ret
Function at 0x414c08
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x429930
call fcn.00427400
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.00413828
push 1
mov ecx, esi
call fcn.0041417f
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.004100df
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.004020f6
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
lea ecx, [ebp - 0x50]
call fcn.00414d9e
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00414d9e
lea eax, [esi + 0x1e4]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1ac], ebx
lea ebx, [esi + 0x1b4]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.00414dcf
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.00414dcf
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x414d22
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x203], 1
jne 0x414d18
push 0x42c1dc
lea ecx, [ebp - 0x50]
call fcn.00402876
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x414d4d
cmp byte [ebp - 0xd], 0
jne 0x414d63
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x203], 1
je 0x414d7c
cmp dword [ebp - 0x34], ebx
jne 0x414d46
push 0x42c1dc
lea ecx, [ebp - 0x38]
call fcn.00402876
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x414d7c
cmp byte [esi + 0x136], 0
jne 0x414d7c
mov ecx, esi
mov byte [esi + 0x135], 1
call fcn.0041516c
jmp 0x414d85
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.004136e1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41578c
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x401630
Capabilities:
Encode data using xor

Disassembly:
push 1
pop edx
cmp dword [esp + 8], edx
jle 0x40164d
mov eax, dword [esp + 4]
lea ecx, [edx + eax]
mov al, dl
imul dl
xor byte [ecx], al
inc edx
cmp edx, dword [esp + 8]
jl 0x401639
ret 8

Function at 0x4017cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x402eb0
call fcn.00402bc0
sub esp, 0x10
push esi
push edi
mov dword [ebp - 4], 1
call sub.MFC42.DLL_AfxGetModuleState
movzx ecx, word [ebp + 0xc]
push dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40188f
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40188f
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402a90
push 0
push 0x1001
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x401851
xor bl, bl
jmp 0x401866
mov eax, dword [ebp - 0x1c]
push edi
push esi
lea ecx, [ebp - 0x1c]
call dword [eax + 0x40]
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CFile::Close
mov bl, 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CFile::CFile
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
mov al, bl
pop ebx
jmp 0x4018a9
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x401a40
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x402f18
call fcn.00402bc0
sub esp, 0x40
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x4c]
push 0x32
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x401268
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x401a94
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push esi
push edi
lea eax, [ebp + 8]
push 0x40125c
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_operator
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
mov esi, dword [eax]
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
je 0x401afa
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x401d50
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
push edi
xor edi, edi
mov esi, ebx
push 8
push edi
mov ecx, ebx
call fcn.00401daa
shl eax, 0x18
push 8
mov dword [esi], eax
pop edx
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x401d6e
push 0x20
push eax
mov ecx, ebx
mov dword [esi], ebp
call fcn.00401daa
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x401d5a
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x401dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov edx, eax
dec eax
test edx, edx
je 0x401e13
mov edx, dword [ebp + 0x10]
inc eax
push ebx
push edi
mov dword [ebp + 8], eax
mov eax, dword [edx]
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [ecx + edi*4]
xor edi, eax
inc esi
dec dword [ebp + 8]
mov dword [edx], edi
jne 0x401df2
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x401e18
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 4], ecx
je 0x401ed3
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x401ed3
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x401e5f
mov ecx, dword [ebp - 4]
or dword [ebp + 0x10], 0xffffffff
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
call fcn.00401dd8
mov eax, dword [ebp + 0x10]
not eax
jmp 0x401ed5
push esi
push 0x118
call sub.MFC42.DLL_operatornew
mov esi, eax
pop ecx
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push 0x401b35
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x401ec7
mov eax, dword [ebp - 4]
and byte [esi + 4], 0
push edi
mov dword [esi], eax
call sub.MFC42.DLL_operatornew
push edi
mov dword [esi + 0x108], eax
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], eax
push ebx
mov dword [esi + 0x114], ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x401ece
push esi
call sub.MFC42.DLL_operatordelete
pop ecx
mov eax, ebx
pop esi
jmp 0x401ed5
xor eax, eax
pop edi
pop ebx
leave
ret 0xc
Function at 0x401edb
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x402f34
call fcn.00402bc0
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.MSVCRT.dll_time]
mov eax, dword [esi + 4]
mov dword [esp], 0x2001f
push eax
lea ecx, [ebp - 0x10]
push dword [esi]
call fcn.0040201f
push 4
test eax, eax
pop edi
jne 0x401f9d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x18], edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x401f9d
fild dword [ebp - 0x14]
fld dword [ebp + 0xc]
fmul dword [0x401570]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
fiadd dword [ebp - 0x20]
fcompp
fnstsw ax
sahf
ja 0x401f8a
mov eax, dword [ebp - 0x14]
push edi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x10], ebx
je 0x401ffe
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401ffb
cmp dword [ebp - 0x10], ebx
je 0x402000
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
jmp 0x402000
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 4]
mov esi, dword [esi]
push ecx
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x401fd8
cmp dword [ebp - 0x10], ebx
je 0x401fd2
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push edi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x10], ebx
je 0x401ffe
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40205d
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov eax, 0x402f50
call fcn.00402bc0
mov eax, 0x10404
call fcn.00402c20
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 1
call fcn.00401d50
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
lea ecx, [ebp + 0xc]
mov eax, dword [eax - 8]
push eax
push ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [ebp - 0x410]
call fcn.00401e18
push ebx
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10410], eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [ebp - 0x1040c]
push eax
call sub.MSVCRT.dll_strcpy
mov edx, dword [ebp + 0xc]
pop ecx
pop ecx
mov eax, dword [edx - 8]
push 4
pop ecx
add eax, ecx
cmp eax, ecx
jbe 0x4020e9
mov al, cl
imul cl
xor byte [ebp + ecx - 0x10410], al
mov eax, dword [edx - 8]
inc ecx
add eax, 4
cmp ecx, eax
jb 0x4020d3
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ebx
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402127
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 8]
add eax, 4
push eax
lea eax, [ebp - 0x10410]
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x402159
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x402f7b
call fcn.00402bc0
mov eax, 0x10410
call fcn.00402c20
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x14], ebx
push 1
mov eax, 0xffff
pop edi
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x1041c]
push ebx
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push ebx
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402246
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1041c]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402246
push 4
pop ecx
cmp dword [ebp - 0x10], ecx
jbe 0x4021ea
mov al, cl
imul cl
xor byte [ebp + ecx - 0x1041c], al
inc ecx
cmp ecx, dword [ebp - 0x10]
jb 0x4021d9
lea ecx, [ebp - 0x41c]
call fcn.00401d50
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 4]
test ecx, ecx
jl 0x40221e
add eax, 0xfffffffc
push ebx
push eax
lea eax, [ebp - 0x10418]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00401e18
cmp dword [ebp - 0x1041c], eax
je 0x402246
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.00402280
mov ecx, dword [ebp + 8]
push 0x4034c0
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x14], edi
jmp 0x402261
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10418]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x14], edi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x402280
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x402f98
call fcn.00402bc0
push ecx
push ecx
push ebx
lea edx, [ebp - 0x14]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
push edx
lea edx, [ebp - 0x10]
xor ebx, ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4022d0
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x10], ebx
je 0x4022ce
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x70e72970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x28cc
call fcn.70e8e510
mov eax, dword [0x70e97050]
xor eax, esp
mov dword [esp + 0x28c8], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, edi
jne 0x70e729b6
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28c8]
xor ecx, esp
call fcn.70e8654c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
cmp byte [eax], 0xeb
jne 0x70e729c9
movzx ecx, byte [eax + 1]
lea edx, [ecx + eax + 2]
mov dword [esi + 8], edx
mov ecx, dword [esi + 8]
mov dword [esp + 0x1c], edi
cmp ecx, edi
je 0x70e7299f
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x34]
push edx
call fcn.70e81f90
add esp, 8
cmp eax, 3
je 0x70e7299f
mov dword [esp + 0x18], edi
cmp dword [esp + 0x1c], edi
jbe 0x70e72b6f
lea eax, [esp + 0xf0]
mov dword [esp + 0x14], eax
mov eax, 0xffffffe8
lea ecx, [esi + 0x18]
sub eax, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], eax
jmp 0x70e72a28
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
cmp ebx, 0xa
jae 0x70e72b6f
mov eax, dword [esi + 8]
cmp byte [eax + ebx], 0xe9
lea ecx, [eax + ebx]
push ebx
mov dword [esp + 0x10], ecx
push eax
je 0x70e72b01
mov edx, dword [esp + 0x18]
add edx, 4
push edx
call fcn.70e89b70
mov eax, dword [esp + 0x20]
mov edi, dword [eax]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 0xc
push edi
push ecx
lea edx, [eax + ebx + 4]
push edx
mov dword [eax], edi
call fcn.70e89b70
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov esi, dword [esi + 8]
add esp, 0xc
add eax, ecx
add eax, edi
add eax, dword [esp + 0x24]
lea edx, [esp + 0xc]
push edx
push 0x40
lea eax, [eax + ebx + 0x1c]
push 0xa
add esi, edi
push eax
add esi, ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x70e72add
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
lea eax, [ecx + 1]
sub esi, eax
sub esi, 4
mov byte [ecx], 0xe9
mov dword [eax], esi
lea eax, [esp + 0x20]
push eax
push edx
push 0xa
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], 0x18
add dword [esp + 0x14], 0xd0
inc eax
add ebx, edi
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jb 0x70e72a20
jmp 0x70e72b6f
lea ecx, [esi + 0x1c]
push ecx
call fcn.70e89b70
imul edi, edi, 0xd0
mov eax, dword [esp + 0x18]
mov edi, dword [esp + edi + 0xfc]
add edi, dword [eax + 1]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x40
push 0xa
lea ebx, [esi + ebx + 0x1c]
push ebx
add edi, eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x70e72b6b
mov ecx, dword [esp + 0xc]
lea eax, [ebx + 1]
sub edi, eax
sub edi, 4
mov byte [ebx], 0xe9
mov dword [eax], edi
lea eax, [esp + 0x20]
push eax
push ecx
push 0xa
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
or dword [esi + 0x14], 1
mov ecx, dword [esp + 0x28d4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.70e8654c
mov esp, ebp
pop ebp
ret
Function at 0x70e72b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
cmp dword [eax], 0
push edi
jne 0x70e72d8e
mov ebx, dword [0x70ea1604]
test ebx, ebx
je 0x70e72c15
mov al, byte [0x70ea1600]
test al, 1
je 0x70e72c15
test al, 2
jne 0x70e72c15
xor edi, edi
cmp byte [ebx], 0
je 0x70e72c0d
lea ecx, [ebx + edi]
mov eax, ebp
jmp 0x70e72bd0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x70e72bf0
test dl, dl
je 0x70e72bec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x70e72bf0
add eax, 2
add ecx, 2
test dl, dl
jne 0x70e72bd0
xor eax, eax
jmp 0x70e72bf5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x70e72c15
lea esp, [esp]
mov cl, byte [ebx + edi]
inc edi
test cl, cl
jne 0x70e72c00
cmp byte [ebx + edi], cl
jne 0x70e72bc6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.70e728e0
test eax, eax
jne 0x70e72d8e
mov edx, dword [esp + 0x18]
call fcn.70e72930
mov edi, eax
cmp dword [edi + 0xac], 0
jne 0x70e72c64
push 0x40
push 0x3000
push 0xa140
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 0xac], eax
test eax, eax
je 0x70e72c0d
push 0xa140
push 0
push eax
call fcn.70e899f0
add esp, 0xc
mov edi, dword [edi + 0xac]
cmp dword [edi + 8], 0
je 0x70e72c7c
add edi, 0x204
cmp dword [edi + 8], 0
jne 0x70e72c70
mov eax, dword [0x70ea1124]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc eax
mov dword [edi + 8], esi
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], ebp
mov dword [ecx], eax
mov ecx, edi
mov dword [0x70ea1124], eax
mov dword [edi], eax
call fcn.70e72970
test eax, eax
je 0x70e72c0d
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [edi + 0xc]
lea edx, [esp + 0x20]
push edx
push 0x40
push 0xa
lea esi, [edi + 0x1f8]
push esi
mov dword [esp + 0x30], 0
call ebp
test eax, eax
je 0x70e72cf6
mov ecx, dword [esp + 0x20]
lea eax, [esi + 1]
sub ebx, eax
sub ebx, 4
mov byte [esi], 0xe9
mov dword [eax], ebx
lea eax, [esp + 0x10]
push eax
push ecx
push 0xa
xor ebx, ebx
push esi
mov dword [esp + 0x20], ebx
call ebp
jmp 0x70e72cf8
xor ebx, ebx
cmp dword [0x70ea15fc], ebx
je 0x70e72d57
cmp dword [0x70ea15f8], 1
jne 0x70e72d57
mov ebx, dword [edi + 8]
lea edx, [esp + 0x20]
push edx
push 0x40
push 0xa
push ebx
mov dword [esp + 0x30], 0
call ebp
test eax, eax
je 0x70e72d48
mov ecx, dword [esp + 0x20]
lea eax, [ebx + 1]
sub esi, eax
sub esi, 4
mov byte [ebx], 0xe9
mov dword [eax], esi
lea eax, [esp + 0x10]
push eax
push ecx
push 0xa
push ebx
mov dword [esp + 0x20], 0
call ebp
or dword [edi + 0x14], 2
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [edi + 8]
lea edx, [esp + 0x20]
push edx
push 0x40
push 0xa
push edi
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
je 0x70e72d8e
mov ecx, dword [esp + 0x20]
lea eax, [edi + 1]
sub esi, eax
sub esi, 4
mov byte [edi], 0xe9
mov dword [eax], esi
lea eax, [esp + 0x10]
push eax
push ecx
push 0xa
push edi
mov dword [esp + 0x20], ebx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret