joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4240a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x428050]
test esi, esi
jle 0x4241c0
mov eax, dword [0x428054]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4240d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x424157
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4240c0
mov dword [esp], ebx
call fcn.00424a90
mov edi, eax
test eax, eax
je 0x4241e7
mov eax, dword [0x428054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00424bd0
mov edx, dword [0x428054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4241c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x424150
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x424160
add dword [0x428050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x428054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x424150
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00424040
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4240de
mov eax, dword [0x428054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00424040
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00424040
lea esi, [esi]
nop

Function at 0x424700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42806c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x428064]
sub esp, 4
test ebx, ebx
je 0x424755
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x42474e
test esi, esi
je 0x42474e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x424730
mov dword [esp], 0x42806c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424a90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x424ab5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x424ac0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x424ab5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x424b08
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x424afe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x424b0a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x424af0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e019a12
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e019a12
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e019a12
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e019a12
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e019a12
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e019a12
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e019a12
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e019a12
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e019a12
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e019a12
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e019a12
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e019a12
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e019a12
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e019a12
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40633c
pop dword [ebp - 0x10]
mov eax, 0xc6bb9f64
add eax, 0x3984c3d8
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xfaaca3af
add dword [ebp - 0x20], 0x53a5a19c
mov dword [ebp - 0x1c], 0x270d2f62
add dword [ebp - 0x1c], 0xb261ce3
mov dword [ebp - 0x18], 0xb26fa7bb
sub dword [ebp - 0x18], 0x6623638d
mov dword [ebp - 0x14], 0x391cc57
add dword [ebp - 0x14], 0xfc6e33a9
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc87b298f
add eax, 0x37c546d1
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5ba45402
add dword [ebp - 0x20], 0x18ce1554
mov dword [ebp - 0x1c], 0x75f10922
add dword [ebp - 0x1c], 0xcb7b5853
mov dword [ebp - 0x18], 0x3c402df7
sub dword [ebp - 0x18], 0xd8d0c18b
mov dword [ebp - 0x14], 0xd75a91e8
sub dword [ebp - 0x14], 0xd75a91e8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x34e19
push 0
call eax
mov ecx, 0xde6a06da
add ecx, 0x21963a33
mov edi, eax
mov ebx, 0x1d7d7f56
sub ebx, 0x1d3c7f56
add ebx, dword [ebp - 0x10]
mov esi, 0x73d5ab6d
add esi, 0x688ca76e
add dword [ebp - 8], ecx
mov edx, dword [ebx]
add dword [ebp - 8], 0x46402dae
xor edx, esi
sub dword [ebp - 0xc], ecx
mov dword [edi], edx
add dword [ebp - 4], edi
add edi, 0x3927c7cf
sub edi, 0x3927c7cb
add ebx, 0x4194c445
sub ebx, 0x4194c441
loop 0x406459
add eax, 0xf707
mov ebx, eax
add eax, 0x9f314036
add eax, 0x60cebfcf
mov ecx, 0xcc8c9a07
add ecx, 0x33b365f9
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x298052f3
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x29841842
call fcn.29802291
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x298053f7
cmp byte [esi + 0x45], bl
je 0x298053f7
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x29805328
xor al, al
jmp 0x298053f9
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.2982e397
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
cmp edi, 0x10
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, ebx
lea ecx, [ebp - 0x28]
cmovae ecx, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [esi + 0x40]
lea eax, [esi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x29805380
dec eax
je 0x29805384
dec eax
dec eax
je 0x298053e1
xor bl, bl
jmp 0x298053e3
mov byte [esi + 0x45], 0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x10
mov ecx, dword [ebp - 0x30]
cmovae eax, ebx
sub ecx, eax
mov dword [ebp - 0x2c], ecx
je 0x298053c3
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, ebx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
cmp ecx, eax
jne 0x2980537c
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [esi + 0x45], 0
je 0x298053e1
test ecx, ecx
jne 0x29805349
push ecx
push 8
lea ecx, [ebp - 0x28]
call fcn.2982e397
jmp 0x29805343
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.2982e397
mov al, bl
jmp 0x298053f9
mov al, 1
call fcn.29802ba0
ret
Function at 0x29805ed7
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x298419c9
call fcn.29802291
mov edi, ecx
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
cmp ebx, esi
jne 0x29805ef6
xor eax, eax
jmp 0x29806008
call dword [sym.imp.MSVCP120.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x29805f28
mov eax, dword [edi + 0x30]
mov ecx, edi
mov edx, dword [edi + 0x20]
mov esi, dword [eax]
add esi, dword [edx]
call dword [sym.imp.MSVCP120.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x29805f25
mov ecx, edi
call dword [sym.imp.MSVCP120.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
jmp 0x29806006
or esi, 0xffffffff
cmp dword [edi + 0x50], 0
jne 0x29805f35
mov eax, esi
jmp 0x29806008
mov ecx, edi
call fcn.298054c7
xor eax, eax
cmp dword [edi + 0x40], eax
jne 0x29805f55
push dword [edi + 0x50]
push ebx
call fcn.2982e397
test al, al
pop ecx
pop ecx
cmovne esi, ebx
jmp 0x29805f2e
push eax
push 8
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.2982e397
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x29805ff5
cmp eax, 1
jg 0x2980603d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov ebx, dword [ebp - 0x34]
cmovae eax, edx
sub ebx, eax
mov dword [ebp - 0x30], ebx
mov ebx, dword [ebp + 8]
je 0x29806010
push dword [edi + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x30]
cmovae eax, edx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp ecx, eax
je 0x29806013
mov ebx, esi
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.2982e397
mov eax, ebx
call fcn.29802ba0
ret 4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov byte [edi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x29805ff7
test ecx, ecx
jne 0x29805f74
cmp dword [ebp - 0x18], 0x20
jae 0x29805ff5
push ecx
push 8
lea ecx, [ebp - 0x28]
call fcn.2982e397
jmp 0x29805f74
cmp eax, 3
jne 0x29805ff5
push dword [edi + 0x50]
push dword [ebp - 0x2c]
call fcn.2982e397
pop ecx
pop ecx
test al, al
mov ecx, esi
cmovne ecx, ebx
mov ebx, ecx
jmp 0x29805ff7
Function at 0x29820bb2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x29843a83
call fcn.29840da1
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x29820d90
push edi
call dword [sym.imp.MSVCR120.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2982e397
add esp, 0x10
test eax, eax
js 0x29820d8a
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x29820c4e
push esi
call fcn.29821d9a
pop ecx
test al, al
je 0x29820c4e
mov eax, esi
call fcn.29841250
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29820c5a
push esi
lea ecx, [ebp - 0x428]
call fcn.2982e397
push 3
push esi
push edi
push eax
call fcn.2982e397
mov esi, eax
test esi, esi
je 0x29820d8a
push 0x60
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x29820ca6
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], eax
test edi, edi
jne 0x29820ca6
call fcn.2981e72e
mov esi, eax
jmp 0x29820d6f
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x29820cc9
call fcn.2981e72e
jmp 0x29820d62
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x29820cbf
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x29820cf9
mov esi, 0x8007000e
jmp 0x29820d64
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2982e397
jmp 0x29820d1f
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29820cf2
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2982e397
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
add esp, 0x10
mov byte [eax + esi], bl
push dword [ebp + 0x14]
push dword [ebp - 0x418]
call fcn.2982e397
mov esi, eax
test edi, edi
je 0x29820d6f
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29820daa
lea ecx, [ebp - 0x418]
call fcn.2981f38a
jmp 0x29820daa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29820da5
lea ecx, [ebp - 0x418]
call fcn.2981f38a
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2981d929
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.29840d5c
ret 0x10
Function at 0x402ad0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004049bc
test esi, esi
jne 0x402b06
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404aac
jmp 0x402b24
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402984
mov edi, eax
test esi, esi
je 0x402b24
cmp dword [ebx], 0
je 0x402b24
dec esi
jmp 0x402b0d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a800c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a90
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a70
xor eax, eax
push ebp
push 0x403a69
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403aac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a70
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4a800c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a800c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40479c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ad04c], 0
je 0x4047fd
cmp word [0x4ad220], 0xd7b2
jne 0x4047c5
cmp dword [0x4ad228], 0
jbe 0x4047c5
mov eax, 0x4ad21c
call dword [0x4ad238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a8074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404824
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a801c], 0
jne 0x404819
push 0
push 0x4a8094
push 0x4a8074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040273c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4ad04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404938
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc