joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ba1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x2c], 0xffffffff
and dword [ebp - 0x28], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call sym.net.dll__ipv6_available_0
push edi
mov ebx, eax
call fcn.100065bc
pop ecx
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x10008be0
push edi
call fcn.100065e8
pop ecx
jmp 0x10008be3
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
jge 0x10008c01
test eax, eax
jns 0x10008c01
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
jmp 0x10008c63
cmp dword [ebp + 0x10], 2
mov dword [ebp - 0x28], 0x10
je 0x10008c1a
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10008c24
cmp dword [ebp - 0x24], 0xffffffff
jne 0x10008c2a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x24], 0xffffffff
je 0x10008bed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10008c55
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x10008bfd
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10008744
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0xc
Function at 0x1000939b
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x10012588]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100093d1
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e6
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10009405
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e5
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x100094d2
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1000947c
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.10008744
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e4
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100094b6
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.10008744
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e4
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x100094e4
push 0
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1000a553
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
call fcn.100091ff
push edi
mov ebx, eax
call fcn.1000922b
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0x14
test ebx, ebx
jns 0x1000a5cd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jns 0x1000a5cd
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0x10
cmp dword [ebp + 0x10], 0xf
jne 0x1000a670
push 0x1c
pop eax
push eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1000a5fa
push edi
call fcn.1000922b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x1000a622
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x1000a5b9
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10008744
mov edi, eax
test edi, edi
je 0x1000a5b9
push dword [ebp - 0x38]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x1000a5b9
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x38]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x1000a5bc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x1000a68e
push str.Invalid_option
jmp 0x1000a5ae
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 4
cmp edi, 0x80
je 0x1000a6a4
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call fcn.10008744
test eax, eax
jns 0x1000a6ce
push str.getsockopt
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x1000a5b9
cmp edi, 8
jg 0x1000a6e9
je 0x1000a709
dec edi
je 0x1000a709
dec edi
dec edi
je 0x1000a71a
dec edi
je 0x1000a709
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x1000a5ae
cmp edi, 0x80
je 0x1000a722
cmp edi, 0x1000
jle 0x1000a6df
cmp edi, 0x1002
jle 0x1000a71a
cmp edi, 0x1003
jne 0x1000a6df
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x1000a5bc
mov eax, dword [ebp - 0x24]
jmp 0x1000a5bc
cmp word [ebp - 0x24], 0
je 0x1000a5b9
movzx eax, word [ebp - 0x22]
jmp 0x1000a5bc
Function at 0x40101f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x12eb110]
jne 0x401029
repz ret
jmp fcn.004012ab

Function at 0x404e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x12eb110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004013b1
and dword [ebp - 0x14], 0
cmp dword [0x12ee224], 0
mov dword [ebp - 0x18], eax
jne 0x404ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x12ee224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x12ee228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x12ee22c], eax
call edi
push eax
call esi
mov dword [0x12ee234], eax
test eax, eax
je 0x404ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x12ee230], eax
mov eax, dword [0x12ee230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x404f1d
cmp dword [0x12ee234], ecx
je 0x404f1d
push eax
call esi
push dword [0x12ee234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404f1d
test ebx, ebx
je 0x404f1d
call edi
test eax, eax
je 0x404f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404f14
test byte [ebp - 8], 1
jne 0x404f1d
or dword [ebp + 0x10], 0x200000
jmp 0x404f50
mov eax, dword [0x12ee228]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404f50
mov eax, dword [0x12ee22c]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x12ee224]
call esi
test eax, eax
je 0x404f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040101f
leave
ret
Function at 0x4041b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x4041fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x4041cd
jmp 0x4041fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4041ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x404261
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.TestTypedEnum.exe_gMozillaPoisonSize]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x404299
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x1c]
jb 0x4042c3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x1c]
jb 0x4042c3
test edi, edi
je 0x404290
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404290
test edi, edi
je 0x4042cb
mov eax, edi
jmp 0x404292
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x404292
int3

Function at 0x4042fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [sym.TestTypedEnum.exe_gMozillaPoisonSize], eax
call fcn.00404261
mov ecx, dword [sym.TestTypedEnum.exe_gMozillaPoisonSize]
mov dword [sym.TestTypedEnum.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x404330
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestTypedEnum.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x8ddf60
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddf66
pop ebp
sub ebp, 6
sub ebp, 0x4ddf60
jmp 0x8ddfc4
jmp 0x8ddfcd
mov eax, 0x4ddf60
add eax, ebp
add eax, 0x93
mov ecx, 0x633
mov edx, 0xec07f0fa
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddfe4
jmp 0x8ddff7
nop
mov edx, 0xfaeafa92
cli
xchg edx, eax
cli
salc
cli
jnp 0x8de00f
push ebp
adc ebx, dword [ecx]
bnd jnp 0x8de015
push ebp
adc ebx, dword [ecx]
leave
leave
cmp ch, byte [edx - 0x243990fb]
mov esi, 0x3771aafa
fstp xword [esi + 0x3771aafa]
jno 0x8de090
invalid
fdivp st(6)
cli
cli
cli
xchg edx, eax
in al, dx
into
cli
xchg edx, eax
mov dl, 0x51
mov esi, 0xded6fbfa
stosd dword es:[edi], eax
adc bh, bh
cli
cli
cli
adc eax, ebp
clc
cli
cli
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
add eax, 0x8f05f68f
adc cl, byte [eax + 0x71fafafa]
inc edi
cli
cli
cli
leave
xor edi, dword [ebx + 8]
mov ecx, 0x7b1ac811
or byte [ecx - 0x36e537ef], bh
sub byte [ecx + 0x12], bh
push dword [edx - 0x54b810b]
cli
cli
cmc
jb 0x8de086
cli
cli
cli
pushfd
jno 0x8de0c0
ret
Function at 0x4165ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
mov dword [ebp - 4], esi
test edi, edi
jne 0x416602
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x4165fb
test byte [eax + 0xbc], 4
je 0x4165fb
cmp byte [eax + 0xb9], 3
jb 0x4165fb
push 0x401918
push reloc.ADVAPI32.dll_EventWrite
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.00415ddb
mov esi, dword [ebp - 4]
mov eax, esi
jmp 0x416741
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x401640
push 0x80000002
call ebx
test eax, eax
je 0x416672
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x41673e
test byte [ecx + 0xbc], 4
je 0x41673e
cmp byte [ecx + 0xb9], 3
jb 0x41673e
push eax
push 0x401918
push 0xc
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
mov ecx, 0x401640
call fcn.0041614d
jmp 0x41673e
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0xc]
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4166db
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x416739
test byte [ecx + 0xbc], 4
je 0x416739
cmp byte [ecx + 0xb9], 3
jb 0x416739
push eax
push 0x401918
push 0xd
push dword [ecx + 0xb4]
mov esi, 0x401640
push dword [ecx + 0xb0]
mov ecx, edi
call fcn.004161c3
jmp 0x416739
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416704
cmp dword [ebp - 0x14], edi
je 0x416734
mov dword [ebp - 4], esi
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x416734
test byte [eax + 0x1c], 8
je 0x416734
cmp byte [eax + 0x19], 5
jb 0x416734
mov ecx, dword [ebp + 8]
push 0x401918
push EventUnregister
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004160dd
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x416ecb
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x4018dc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, reloc.ADVAPI32.dll_EventActivityIdControl
jne 0x416f38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x416fc8
push 0
push 0x4018dc
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x416fc8
inc edi
cmp edi, 5
jb 0x416ee8
xor edi, edi
push edi
push edi
lea eax, reloc.ADVAPI32.dll_EventActivityIdControl
push eax
push esi
mov dword [ebp - reloc.ADVAPI32.dll_EventActivityIdControl], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x416fc1
mov dword [ebp - reloc.ADVAPI32.dll_EventActivityIdControl], 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp + 8]
mov dword [ebp - reloc.ADVAPI32.dll_EventActivityIdControl], eax
mov eax, 0x104
lea edx, reloc.ADVAPI32.dll_EventActivityIdControl
call fcn.00416fde
push edi
lea eax, reloc.ADVAPI32.dll_EventActivityIdControl
push eax
push 4
lea eax, reloc.ADVAPI32.dll_EventActivityIdControl
push eax
push esi
mov dword [ebp - reloc.ADVAPI32.dll_EventActivityIdControl], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416fc1
push edi
lea eax, reloc.ADVAPI32.dll_EventActivityIdControl
push eax
mov ecx, 0x214
push ecx
lea eax, reloc.ADVAPI32.dll_EventActivityIdControl
push eax
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bdaf
leave
ret 8
Function at 0x4195bc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
and dword [ebp - 4], edi
mov dword [ebp - 8], 7
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41967a
mov ecx, dword [ebp - 8]
push 2
pop edx
cmp ecx, 7
je 0x419609
cmp ecx, 1
je 0x419609
cmp ecx, edx
jne 0x41963b
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
test edi, edi
jne 0x4196d3
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b9fe
mov edi, eax
test edi, edi
je 0x419695
push 2
inc ebx
pop edx
cmp ebx, edx
jb 0x4195d4
jmp 0x4196d8
mov esi, 0x64a
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x41967a
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x41967a
cmp byte [eax + 0xb9], 2
jb 0x41967a
push ecx
push 0x404918
push 0x28
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test edi, edi
je 0x419687
push edi
call fcn.0042b5de
pop ecx
xor edi, edi
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
push 8
pop esi
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x419687
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x419687
cmp byte [eax + 0xb9], 2
jb 0x419687
push 0x404918
push 0x29
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.00415ddb
jmp 0x419687
mov word [edi + eax*2 - 2], cx
cmp dword [ebp - 8], edx
jne 0x41977a
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4196fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x419772
push 2
xor ecx, ecx
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b9fe
mov ebx, eax
test ebx, ebx
jne 0x419720
push 8
pop esi
jmp 0x41967a
push esi
push ebx
xor eax, eax
push edi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x419745
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call fcn.0042b5de
jmp 0x419771
cmp eax, esi
jbe 0x419758
push 0xd
pop esi
push ebx
call fcn.0042b5de
pop ecx
jmp 0x41967a
push edi
call fcn.0042b5de
mov eax, dword [ebp + 0xc]
add eax, eax
mov edi, ebx
mov dword [ebp - 4], eax
xor esi, esi
mov dword [ebp - 8], 1
pop ecx
test esi, esi
jne 0x41967a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x419687
Function at 0x41da84
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp + 8]
push eax
push 0x20019
xor edi, edi
push edi
push 0x402b00
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x41db09
mov dword [ebp + 8], edi
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x41daf7
test byte [eax + 0xbc], 4
je 0x41daf7
cmp byte [eax + 0xb9], 2
jb 0x41daf7
push esi
push 0x40bf9c
push reloc.ADVAPI32.dll_EventUnregister
push dword [eax + 0xb4]
mov ecx, 0x402b00
push dword [eax + 0xb0]
call fcn.0041614d
mov edi, dword [ebp + 8]
test esi, esi
jle 0x41db75
and esi, 0xffff
or esi, 0x80070000
jmp 0x41db75
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x4065c0
push dword [ebp + 8]
mov dword [ebp + 0xc], edi
call esi
test eax, eax
jne 0x41db3c
cmp dword [ebp - 4], 1
jne 0x41db3c
cmp dword [ebp + 0xc], edi
je 0x41db3c
or byte [ebx + 0x111], 1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x4065dc
push dword [ebp + 8]
mov dword [ebp + 0xc], 4
call esi
test eax, eax
jne 0x41db70
cmp dword [ebp - 4], 4
jne 0x41db70
cmp dword [ebp - 8], edi
jne 0x41db70
or byte [ebx + 0x111], 2
mov esi, edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41db80
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41ffbe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x42d08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x42d080]
xor edi, edi
mov ebx, edi
jmp 0x420019
cmp dword [esi + reloc.ADVAPI32.dll_EventActivityIdControl], edi
jne 0x420017
mov edx, dword [esi + 0x28]
push 0x7fffffff
lea eax, [ebp - 4]
call fcn.0041bed4
test eax, eax
setns al
movzx eax, al
push eax
push 0x4094a8
push edi
push edi
push edi
mov ecx, 0x4094c8
call fcn.0042ba80
mov eax, dword [ebp - 4]
inc eax
add ebx, eax
mov esi, dword [esi]
cmp esi, 0x42d080
jne 0x41ffde
push 2
inc ebx
xor ecx, ecx
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b9fe
mov edi, eax
test edi, edi
jne 0x420088
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x420133
test byte [ecx + 0xbc], 4
je 0x420133
cmp byte [ecx + 0xb9], 2
jb 0x420133
push ebx
push 0x40bf9c
push 0x38
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
call fcn.0041722a
jmp 0x420133
xor eax, eax
mov word [edi], ax
mov esi, dword [0x42d080]
jmp 0x4200d9
cmp dword [esi + reloc.ADVAPI32.dll_EventActivityIdControl], 0
jne 0x4200d7
push dword [esi + 0x28]
mov edx, ebx
push edi
call fcn.004171bf
test eax, eax
js 0x4200bc
push 0x409598
push edi
mov edx, ebx
call fcn.004171bf
test eax, eax
setns al
movzx eax, al
push eax
push 0x4095a0
xor eax, eax
push eax
push eax
push eax
mov ecx, 0x4095f8
call fcn.0042ba80
mov esi, dword [esi]
cmp esi, 0x42d080
jne 0x420095
push edi
push 0x4096c8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x420133
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x420133
test byte [eax + 0xbc], 4
je 0x420133
cmp byte [eax + 0xb9], 2
jb 0x420133
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x42d05c]
push 0x40bf9c
push 0x39
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
push 0x42d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call fcn.0042b5de
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x423698
Capabilities:
Check for debugger via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x42373a
cmp dword [0x42d904], 0
je 0x42371a
cmp dword [ebp + 0xc], 0
je 0x42371a
call dword [sym.imp.WUDFPlatform.dll_WudfIsKernelDebuggerPresent]
cmp eax, 1
jne 0x42371a
call dword [sym.imp.WUDFPlatform.dll_WudfIsUserDebuggerPresent]
test eax, eax
jne 0x42371a
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call fcn.004232ce
test eax, eax
js 0x4236fd
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x40c3f0
push 0
push 0x65
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x18
jmp 0x423712
push dword [ebp + 0x10]
push 0x40c448
push 0
push 0x65
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x10
push 2
call dword [sym.imp.WUDFPlatform.dll_WudfDebugBreakPoint]
mov eax, dword [0x42da88]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xd0]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
leave
ret 0xc