joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43df70
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44dfe9
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x7f
push 0x66
mov ecx, dword [ebp - 0x13c]
call fcn.0040f024
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x13c]
mov dword [ecx], vtable.CHPSoftwareSetupDlg.0
mov edx, dword [ebp - 0x13c]
mov dword [edx + 0x74], vtable.CHPSoftwareSetupDlg.1.0
mov ecx, dword [ebp - 0x13c]
add ecx, 0xe4e4
call fcn.00401be0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x13c]
add ecx, 0xe6f8
call fcn.00401be0
mov byte [ebp - 4], 2
push 0x80
call fcn.00402d80
mov ecx, eax
call fcn.00402da0
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + 0xe6f0], eax
push 0x114
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.00422660
add esp, 0xc
mov dword [ebp - 0x12c], 0x114
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 5
jne 0x43e066
cmp dword [ebp - 0x124], 1
jne 0x43e066
mov dword [ebp - 0x140], 1
jmp 0x43e070
mov dword [ebp - 0x140], 0
mov ecx, dword [ebp - 0x13c]
mov dl, byte [ebp - 0x140]
mov byte [ecx + 0xe6f4], dl
mov eax, dword [ebp - 0x13c]
mov byte [eax + 0xe6fc], 0
mov ecx, dword [ebp - 0x13c]
movzx edx, byte [ecx + 0xe6f4]
test edx, edx
je 0x43e1da
lea ecx, [ebp - 0x130]
call fcn.00401be0
mov byte [ebp - 4], 3
push 0x104
push 0x105
lea ecx, [ebp - 0x130]
call fcn.00401850
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x130]
call fcn.00402d30
push 1
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401d30
mov dword [ebp - 0x144], eax
push 0x4584f4
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00402050
add esp, 8
mov byte [ebp - 0x131], al
lea ecx, [ebp - 0x138]
call fcn.00401a80
movzx edx, byte [ebp - 0x131]
test edx, edx
je 0x43e133
push 0x5c
lea ecx, [ebp - 0x130]
call fcn.00402cc0
push str.Temp
lea ecx, [ebp - 0x130]
call fcn.00402070
push 0
lea ecx, [ebp - 0x130]
call fcn.004024c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x130]
call fcn.004024c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43e1af
lea ecx, [ebp - 0x130]
call fcn.004024c0
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x43e1af
lea ecx, [ebp - 0x130]
call fcn.004024c0
push eax
push 0x4585a8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x43e1af
mov dword [ebp - 0x148], 0
jmp 0x43e1b9
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x13c]
mov cl, byte [ebp - 0x148]
mov byte [eax + 0xe6f4], cl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00401a80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 4
Function at 0x43e6d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43e705
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x14]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x43e74a
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp - 0x20]
call fcn.0043dd50
push 0x80040001
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x43e76f
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x442650
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0
push str.ssm.exe
mov eax, dword [ebp + 8]
push eax
call fcn.00401c00
add esp, 8
test eax, eax
je 0x44267d
mov ecx, dword [ebp - 0x64]
call fcn.00440330
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
push 0x44
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.00422660
add esp, 0xc
mov dword [ebp - 0x60], 0x44
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00422660
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x400
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [0x46db80], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x447e50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00422660
add esp, 0xc
mov dword [ebp - 4], 0
push str.c:_system.sav
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.c:_system.savLogs
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.c:_system.savSSM_Log
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.C:SwSetup
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.C:SwSetupAppInstl
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.C:SwSetupAppInstlInstallSP
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x104
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.00422660
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret
Function at 0x4481b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x674], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00422660
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00422660
add esp, 0xc
mov byte [ebp - 0x669], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, eax
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x45e124
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x668]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0xffffffff
jne 0x4482b1
xor eax, eax
jmp 0x4483a1
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
cmp dword [ebp - 0x674], 0
jne 0x448361
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [ebp - 0x63c]
push ecx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x63c]
push ecx
call fcn.004233da
add esp, 0xc
test eax, eax
jne 0x44832f
mov byte [ebp - 0x669], 1
mov dword [ebp - 0x674], 1
jmp 0x448361
lea edx, [ebp - 0x668]
push edx
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44835c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x44835c
mov dword [ebp - 0x674], 1
jmp 0x4482cc
mov ecx, dword [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.00422660
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00422660
add esp, 0xc
movzx eax, byte [ebp - 0x669]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 4
Function at 0x448420
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x670], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00422660
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00422660
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
jne 0x4484ce
xor eax, eax
jmp 0x448588
cmp dword [ebp - 0x670], 0
jne 0x44854a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x45e038
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x668]
push eax
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x448548
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x448548
mov dword [ebp - 0x670], 1
jmp 0x4484ce
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.00422660
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00422660
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 4
Function at 0x448cb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x408], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call fcn.00422660
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0x45d10c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 4], eax
push 0x45d114
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x448d46
push 0x45d11c
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], 0xffffffff
jmp 0x448d4d
mov dword [ebp - 4], 0
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
push 0
lea ecx, [ebp - 0x408]
push ecx
call fcn.00422660
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4491c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x41c], ecx
mov byte [ebp - 9], 0
mov dword [ebp - 0x414], 0x200
xor eax, eax
mov word [ebp - 0x410], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x40e]
push ecx
call fcn.00422660
add esp, 0xc
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0x45cd24
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x45cd2c
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44925d
push 0x45cd34
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4492f0
mov byte [ebp - 9], 1
cmp dword [ebp + 0x10], 0
je 0x44926d
cmp dword [ebp + 0xc], 0
jne 0x4492df
lea edx, [ebp - 0x410]
mov dword [ebp - 0x418], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x418]
movzx edx, word [ecx]
test edx, edx
jne 0x44929a
mov eax, dword [ebp - 0x418]
movzx ecx, word [eax + 2]
test ecx, ecx
je 0x4492dd
mov edx, dword [ebp - 0x418]
movzx eax, word [edx]
test eax, eax
jne 0x4492b4
mov ecx, 0x7c
mov edx, dword [ebp - 4]
mov word [edx], cx
jmp 0x4492c3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x418]
mov dx, word [ecx]
mov word [eax], dx
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x418]
add ecx, 2
mov dword [ebp - 0x418], ecx
jmp 0x44927f
jmp 0x4492f0
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x200
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.00422660
add esp, 0xc
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 0x10
Function at 0x449690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x15], 0
cmp dword [ebp + 0xc], 0x45cd1c
jne 0x4496af
movzx eax, byte [ebp - 0x15]
jmp 0x449789
lea eax, [ebp - 0x10]
push eax
push 0x201
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4496e4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [ebp - 0x15]
jmp 0x449789
lea ecx, [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
jbe 0x44977b
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402e52
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x449769
cmp dword [ebp - 8], 1
jne 0x449769
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 0x15], 1
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00402e47
add esp, 4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [ebp - 0x15]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x449790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4497d4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x449815
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x449808
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x449815
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x449820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44986a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4498b8
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x412080
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x503778
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x53
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x78
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x28
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xf0
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xfc
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0x67
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 9
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xfa
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xe
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x8e
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x1c
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 9
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xfd
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x6e
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x412674
sub esp, 0x20
mov eax, dword [0x501358]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126f3
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x503860
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x41270d
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a5
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f5
Function at 0x49062c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dac
mov eax, dword [0x501358]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405dda
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x49066e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4907ca
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405f2e
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x504e18]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403247
mov ecx, dword [esi*4 + 0x504e18]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4907c3
cmp eax, dword [edi + ecx + 0x24]
jne 0x4907c3
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4907c3
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403247
add esp, 0x14
test edx, edx
jl 0x4907c3
jg 0x490739
test eax, eax
jb 0x4907c3
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4907c3
jl 0x490753
cmp dword [ebp - 0x1008], eax
ja 0x4907c3
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x490771
test ebx, ebx
je 0x4907aa
cmp ecx, edi
jae 0x4907aa
mov al, byte [ecx]
cmp al, 0xd
jne 0x49078b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x490797
cmp byte [ecx + 1], 0xa
jne 0x490797
inc ecx
jmp 0x490797
movzx eax, al
movsx eax, byte [eax + 0x501670]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x490771
cmp edx, ebx
jne 0x490771
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4907c8
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403030
leave
ret