joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [esi + 0x18]
test bl, bl
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
je 0x403e01
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
add edx, ecx
push eax
push 0x18
mov dword [esi + 0x14], edx
push ecx
lea edx, [esi + 0x24]
lea ebx, [esi + 0x20]
mov ecx, esp
push edx
mov dword [esp + 0x2c], ebx
call fcn.004038a0
push ecx
mov ecx, esp
push str.read
call fcn.00402430
push ebx
call fcn.00402280
mov ecx, dword [esi + 0x18]
mov ebp, dword [esi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
mov edx, ebp
dec ebp
test edx, edx
je 0x403da2
inc ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
mov dl, byte [esp + 0x13]
test dl, dl
je 0x403d1a
xor edx, edx
cmp byte [edi], dl
jmp 0x403d1f
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x403d46
test eax, eax
je 0x403d3f
cmp edi, eax
je 0x403d3f
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
mov ecx, dword [esi + 0x18]
inc ebx
lea eax, [ecx + edi]
mov edx, dword [esp + 0x14]
add edi, ecx
dec edx
mov dword [esp + 0x14], edx
jne 0x403d0c
test eax, eax
je 0x403d6d
cmp edi, eax
je 0x403d6d
mov ecx, dword [esi + 0x18]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
test ebx, ebx
je 0x403da2
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov ecx, esp
push 0
call fcn.00402430
push ecx
mov ecx, esp
push str.nulls_removed
call fcn.00402430
mov edx, dword [esp + 0x2c]
push edx
call fcn.00402280
mov eax, dword [esi + 0x1c]
add esp, 0x18
sub eax, ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x18], 1
jle 0x403df3
mov eax, dword [esi + 4]
push eax
call fcn.00402d80
add esp, 4
test al, al
je 0x403df3
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call fcn.00402d90
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.00402430
push ecx
mov ecx, esp
push str.endian_swap
call fcn.00402430
mov eax, dword [esp + 0x2c]
push eax
call fcn.00402280
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, esi
call fcn.00403780
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4046a0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [esp + 0x14]
imul eax, dword [ebp + 0x1c]
test esi, esi
mov dword [ebp + 8], eax
jne 0x4046be
mov esi, edi
mov ecx, dword [ebp + 4]
xor ebx, ebx
push ecx
call fcn.00402d80
add esp, 4
test al, al
je 0x404733
test edi, edi
jne 0x4046fd
mov edx, dword [ebp + 0x1c]
shl edx, 1
push edx
call sub.MFC42.DLL_operatornew
mov ecx, dword [ebp + 0x1c]
mov ebx, eax
shl ecx, 1
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov esi, ebx
mov ecx, dword [ebp + 0x1c]
push ecx
push edi
call fcn.00402d90
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.00402430
push ecx
mov ecx, esp
push str.endian_swap
call fcn.00402430
lea edx, [ebp + 0x20]
push edx
call fcn.00402280
add esp, 0x18
mov eax, dword [ebp]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete byte [esp + 0x18]
test ebx, ebx
je 0x40475c
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0x18]
test al, al
je 0x4047a7
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
push eax
push 0x18
add esi, edx
push ecx
lea edx, [ebp + 0x24]
mov ecx, esp
push edx
mov dword [ebp + 0x14], esi
call fcn.004038a0
push ecx
mov ecx, esp
push str.write
call fcn.00402430
add ebp, 0x20
push ebp
call fcn.00402280
mov al, byte [esp + 0x30]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebp
call fcn.00403780
mov al, byte [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x405820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41ce93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], ebx
mov edi, dword [ebx + 0x30]
mov dword [esp + 0x1c], 1
test edi, edi
mov dword [esp + 0xc], edi
je 0x4058e7
push ebp
mov ebp, dword [edi]
test ebp, ebp
je 0x4058dd
mov esi, dword [ebp]
test esi, esi
je 0x4058cc
add ebp, 4
test esi, esi
je 0x4058c5
cmp dword [esi], 0
je 0x4058bc
mov eax, dword [esi + 4]
xor ebx, ebx
test eax, eax
jle 0x4058ad
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4058a5
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x405050
push ecx
push 0xc
push eax
call fcn.0041c6ac
push edi
call sub.MFC42.DLL_operatordelete
mov edi, dword [esp + 0x14]
add esp, 4
mov eax, dword [esi + 4]
inc ebx
cmp ebx, eax
jl 0x40587b
mov eax, dword [esi]
push eax
call sub.MFC42.DLL_operatordelete
mov ebx, dword [esp + 0x18]
add esp, 4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esi, dword [ebp]
test esi, esi
jne 0x405866
mov eax, dword [edi]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi], 0
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop ebp
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x40592f
mov edx, dword [esi + 4]
xor edi, edi
dec edx
sar edx, 0x10
inc edx
test edx, edx
jle 0x405917
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esi + 4]
add esp, 4
inc edi
dec ecx
sar ecx, 0x10
inc ecx
cmp edi, ecx
jl 0x4058fc
mov eax, dword [esi]
test eax, eax
je 0x405926
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [ebx + 4]
mov byte [esp + 0x1c], 0
call fcn.0041c2f4
mov ecx, ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0041c2f4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40cd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41d5c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x426f58
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
lea edx, [esp + 0x38]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.0040ce40
lea eax, [esp + 8]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.0040ce10
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x30], 4
call fcn.0041c3ea
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.0041c2f4
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call fcn.0040cf50
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call fcn.0041c2f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.0041c50a
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041c2f4
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x40f290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41d938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x426f58
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
lea edx, [esp + 0x38]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.0040f390
lea eax, [esp + 8]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.0040ce10
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x30], 4
call fcn.0041c3ea
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.0041c2f4
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call fcn.0040f4a0
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call fcn.0041c2f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.0041c50a
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041c2f4
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x411940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41dcf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x426f58
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
lea edx, [esp + 0x38]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.00410a50
lea eax, [esp + 8]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.0040ce10
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x30], 4
call fcn.0041c3ea
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.0041c2f4
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call fcn.004116f0
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
call fcn.0041c2f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.0041c50a
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041c2f4
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x413c40
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x41e47f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebp, ecx
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 2
mov edi, dword [eax - 8]
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
mov byte [esp + 0x3c], 3
and ecx, 0x80000001
jns 0x413c90
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x413d33
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov bl, 4
test edi, edi
mov byte [esp + 0x3c], bl
jle 0x413d25
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Empty
mov edx, dword [esp + 0x48]
mov al, byte [esi + edx]
mov byte [esp + 0x1c], al
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041c612
mov edx, dword [esp + 0x48]
mov al, byte [esi + edx + 1]
mov byte [esp + 0x20], al
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_2
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x28]
mov ecx, ebp
push eax
call fcn.00413e20
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], bl
call fcn.0041c2f4
add esi, 2
cmp esi, edi
jl 0x413ca9
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 3
call fcn.0041c2f4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 7
push ecx
lea ecx, [esp + 0x14]
call fcn.0041c3ea
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
xor edi, edi
mov ebx, dword [edx - 8]
mov ebp, dword [eax - 8]
test ebx, ebx
jle 0x413d9e
xor esi, esi
test ebp, ebp
jle 0x413d99
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x10]
mov al, byte [edi + edx]
mov cl, byte [esi + ecx]
not al
xor al, cl
lea ecx, [esp + 0x10]
push eax
push esi
call sub.MFC42.DLL_CString::SetAt
inc esi
cmp esi, ebp
jl 0x413d77
inc edi
cmp edi, ebx
jl 0x413d71
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov ebx, 1
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 6
call fcn.0041c2f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.0041c2f4
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
call fcn.0041c2f4
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], bl
call fcn.0041c2f4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3c], 0
call fcn.0041c2f4
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 0xc
Function at 0x413e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e4b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x24], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [esp + 8]
cmp al, 0x30
jb 0x413e87
cmp al, 0x39
ja 0x413e87
mov cl, al
shl cl, 4
mov byte [esp + 8], cl
jmp 0x413ea1
cmp al, 0x41
jb 0x413e9d
cmp al, 0x46
ja 0x413e9d
mov cl, al
add cl, 9
shl cl, 4
mov byte [esp + 8], cl
jmp 0x413ea1
mov cl, byte [esp + 8]
cmp ah, 0x30
jb 0x413eb1
cmp ah, 0x39
ja 0x413eb1
mov al, ah
sub al, 0x30
jmp 0x413ebf
cmp ah, 0x41
jb 0x413ec5
cmp ah, 0x46
ja 0x413ec5
mov al, ah
sub al, 0x37
add cl, al
mov byte [esp + 8], cl
mov esi, dword [esp + 8]
lea ecx, [esp + 0x10]
and esi, 0xff
push 0xa
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea ecx, [esp + 0x30]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
push esi
lea edx, [esp + 0xc]
push 0x427414
push edx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x38]
add esp, 0xc
lea eax, [esp + 8]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.0041c2f4
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.0041c2f4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x415700
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0041c2f4
mov eax, esi
pop esi
add esp, 0xc
ret 4
Function at 0x41af80
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x18], 5
mov dword [ecx + 0x1c], 4
mov dword [ecx + 0x20], 6
mov dword [ecx + 0x24], 0xc
mov dword [ecx + 0x28], 9
mov dword [ecx + 0x2c], 0xb
mov dword [ecx + 0x30], 0xa
mov dword [ecx + 0x34], 0x11
mov dword [ecx + 0x38], 0xe
mov dword [ecx + 0x3c], 0x10
mov dword [ecx + 0x40], 0xf
mov dword [ecx + 0x44], 0x16
mov dword [ecx + 0x48], 0x14
mov dword [ecx + 0x4c], 0x17
mov dword [ecx + 0x50], 0x15
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret
Function at 0x4014e0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x401500
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esi]
push edi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x401530
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x401542
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x401d50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x42f180]
mov edx, dword [esp + 0x220]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x22c], eax
mov eax, dword [edi]
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
jne 0x401dba
test ecx, ecx
je 0x401dac
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], ecx
je 0x401dc8
test ecx, ecx
je 0x401e6b
push ecx
jmp 0x401e65
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x401e32
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.00401d50
mov edi, eax
test edi, edi
jne 0x401e84
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x401df4
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x401e49
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x228]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x401e6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x218]
call fcn.00419d15
add esp, 0x21c
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x401e93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x220]
mov eax, edi
pop edi
pop esi
call fcn.00419d15
add esp, 0x21c
ret 4
Function at 0x404550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424c76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
mov eax, dword [0x42f180]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x42f060]
xor ebx, ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x418], ebx
mov eax, dword [ebp + 8]
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x420], edi
jne 0x4045ca
call fcn.004011d0
mov esi, eax
jmp 0x4046bb
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4045e9
call fcn.004011d0
jmp 0x4046b2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x41c], ebx
jne 0x404607
call fcn.004011d0
jmp 0x4046b2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + esi + 2]
cmp eax, 0x400
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
jbe 0x404637
push eax
lea ecx, [ebp - 0x418]
call fcn.00401c90
jmp 0x404654
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x404654
mov eax, dword [ebp - 0x418]
test eax, eax
mov dword [ebp - 4], 1
jne 0x40466c
mov esi, 0x8007000e
jmp 0x4046b4
call dword [0x42f060]
mov ecx, dword [ebp - 0x418]
push esi
push ecx
push esi
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x404690
call fcn.004011d0
jmp 0x4046b2
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp + 0x14]
mov word [edx + esi*2], 0
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x428]
call fcn.004041f0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
cmp eax, edx
je 0x4046d6
lea ecx, [ebp - 0x418]
call fcn.00401c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00419d15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x424e56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
mov eax, dword [0x430b50]
push edi
mov ecx, 0x430b50
mov dword [esp + 0xc], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov dword [esp + 0x18], ebp
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 2
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 3
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 4
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 6
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov eax, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 7
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 8
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
mov eax, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 9
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], 0xa
mov edx, dword [0x430b50]
mov ecx, 0x430b50
mov byte [esp + 0x18], 0xb
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x58], eax
lea edi, [esi + 0x74]
mov ecx, edi
mov byte [esp + 0x18], 0xc
call fcn.00403010
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x80]
mov ecx, edi
mov byte [esp + 0x18], 0xd
call fcn.00403010
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0xa4]
mov ecx, edi
mov byte [esp + 0x18], 0xe
call fcn.00403010
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0xc8]
mov ecx, edi
mov byte [esp + 0x18], 0xf
call fcn.00403220
mov dword [edi + 4], eax
mov byte [eax + 0x35], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
push ebp
push ebp
mov dword [eax + 8], eax
push ebp
mov dword [edi + 8], ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xd4], eax
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret