joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4738d3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4a9e6c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x473975
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x473a77
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x473a25
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysFreeString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473a78
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473a1a
cmp dword [ebp - 0x24], 1
jne 0x473a1a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x48e7d8
push eax
call fcn.0043b43f
add esp, 0xc
cmp eax, 1
jne 0x473a1a
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x473a78
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x473a78
lea ecx, [ebp - 0x18]
push ecx
push 0x4738bd
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x473a78
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x473a9e
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0047383e
cmp eax, ebx
pop ecx
pop ecx
jne 0x473aa0
inc edi
cmp edi, esi
jl 0x473a87
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004368a4
leave
ret 4
Function at 0x473aaf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x4a9058
je 0x473b6b
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473b53
mov esi, dword [ebx + 4]
jmp 0x473b4d
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473b3d
cmp dword [ebp - 0xc], 4
jne 0x473b3d
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x473b35
or dword [eax + 0x9c], ecx
jmp 0x473b3d
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x473b01
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x473ae4
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x4743f8
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x48025c
call fcn.00439a10
sub esp, 0x11c
mov eax, dword [0x4a9e6c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x4744f1
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4744c5
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00406f90
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.004743f8
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401830
test bl, bl
jne 0x4744c5
or dword [ebp - 4], 0xffffffff
jmp 0x474436
cmp esi, 0x103
je 0x4744d5
cmp esi, 0x3f2
jne 0x4744e5
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004368a4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4748e3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x4802b3
call fcn.00439a10
mov eax, 0x1014
call fcn.00437870
mov eax, dword [0x4a9e6c]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x4749de
push dword [ebp + 0xc]
call fcn.00474834
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x47492c
push dword [ebp + 0x14]
jmp 0x474a0f
push esi
call fcn.00456579
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x4749a9
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.00404700
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.00404010
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x4749cc
lea eax, [ebp + 0xc]
push eax
call fcn.00406540
jmp 0x4749d4
push dword [ebp + 0x14]
call fcn.00406f90
lea ecx, [ebx - 0x10]
call fcn.00401830
jmp 0x474a17
cmp dword [ebp + 0x14], edi
jne 0x4749ea
mov dword [ebp + 0x14], 0x483e6c
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406f90
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004368a4
leave
ret 0x10

Function at 0x474cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x474d25
cmp edi, dword [esi + 0xc]
jge 0x474d25
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x474d25
cmp edi, dword [eax + 8]
jge 0x474d25
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x474d27
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x474eae
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x474ee2
jmp fcn.0044b5a7
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x474f53
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x47504c
cmp eax, dword [edi + 0xc]
jge 0x47504c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x474fa4
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x475035
cmp dword [ebp + 0xc], ebx
je 0x475035
jmp 0x474fce
push 0x10
call fcn.00474bbc
cmp eax, ebx
je 0x474fba
mov ecx, eax
call fcn.00474e7b
mov esi, eax
jmp 0x474fbc
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x474fe5
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x474ff5
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x475007
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0044b5a7
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00439a30
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x475047
cmp ecx, dword [esi + 8]
jge 0x475047
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x47504d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x475b2e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4a9e6c]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004371fd
mov esi, eax
test esi, esi
pop ecx
je 0x475bd6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x475bcc
push edi
mov edi, SysReAllocString
push ebx
push eax
push esi
mov byte [eax], 0
call fcn.0043a195
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x475bca
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x475ba4
inc ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x475bca
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.0043799b
test eax, eax
pop ecx
pop ecx
jne 0x475b65
pop ebx
pop edi
push esi
call fcn.00437b65
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.004368a4
leave
ret 4
Function at 0x479fc1
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 4], eax
and dword [ebp - 4], 1
push edi
mov edi, str.Insertable
je 0x47a027
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 0
mov ebx, 0x483e6c
push ebx
push 1
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47a001
push eax
push ebx
push 1
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x47a024
xor esi, esi
cmp dword [ebp - 4], 0
je 0x47a01b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push dword [ebp + 0xc]
call ebx
push edi
push dword [ebp + 8]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 0x10]
xor ebx, ebx
test al, 2
je 0x47a032
mov ebx, str.Apartment
test al, 4
je 0x47a03b
mov ebx, str.Free
and eax, 6
cmp al, 6
jne 0x47a047
mov ebx, str.Both
test ebx, ebx
je 0x47a0a1
lea eax, [ebp + 0x10]
push eax
push 0x20006
push 0
push str.InprocServer32
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x47a003
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
push 1
push 0
push str.ThreadingModel
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x47a003
xor eax, eax
inc eax
jmp 0x47a01d
Function at 0x47a17a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x4817f6
call fcn.00439a10
sub esp, 0x118
mov eax, dword [0x4a9e6c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
call fcn.00456579
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x118], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00456579
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
mov edi, SysReAllocString
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x120], ebx
jne 0x47a1f1
lea eax, [ebp - 0x120]
push eax
push 0x20019
push ebx
push str.CLSID
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 0x124], 1
je 0x47a2dc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp + 8], 4
cmp dword [ebp + 0x18], edi
jne 0x47a220
cmp byte [esi], 0
je 0x47a2c1
push esi
call ebx
push dword [ebp + 0x10]
lea eax, [eax + esi + 1]
push dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.004658af
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push dword [ebp + 0xc]
push dword [ebp - 0x114]
push eax
call fcn.004658af
cmp dword [ebp + 0x18], edi
mov eax, dword [ebp - 0x118]
jne 0x47a269
cmp dword [eax - 0xc], 0
je 0x47a2c1
cmp dword [ebp + 0x14], 0
jne 0x47a29b
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x114], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x47a2c1
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x11c]
push esi
mov dword [ebp - 0x114], eax
call ebx
push eax
push esi
push 1
push dword [ebp - 0x114]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x47a2d0
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
jne 0x47a20e
jmp 0x47a2dc
cmp eax, 5
je 0x47a2dc
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x120], 0
pop edi
pop esi
pop ebx
je 0x47a2f4
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.00401830
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.00401830
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x124]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004368a4
leave
ret 0x14
Function at 0x442890
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4428f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x68d06c]
test esi, esi
jle 0x442a10
mov eax, dword [0x68d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x442924
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4429a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x442910
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x442a37
mov eax, dword [0x68d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x68d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x442a17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4429a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4429b0
add dword [0x68d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x68d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4429a0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x44292e
mov eax, dword [0x68d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x442f50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x68d088
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [0x68d080]
sub esp, 4
test ebx, ebx
je 0x442fa5
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x442f9e
test esi, esi
je 0x442f9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x442f80
mov dword [esp], 0x68d088
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4432e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x443305
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x443310
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x443305
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x443358
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x44334e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x44335a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x443340
xor eax, eax
pop ebx
pop esi
ret

Function at 0x41de93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x41de93
lcall 0x5de5, 0x8b10c483
jmp fcn.0096ab4c

Function at 0x40180b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40184a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40184a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40184a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40184a
cmp dword [ecx + 0x74], 0xe
jbe 0x40184a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc
Function at 0x40fa40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x474b2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00469631
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40fac2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046705a
mov eax, dword [eax]
push 0x760220
push eax
call fcn.004593e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004698bc
test bl, bl
je 0x40fac2
push 0x760220
lea ecx, [esp + 0xc]
call fcn.00469c4c
push 0x763d70
lea ecx, [esp + 0xc]
call fcn.00469c4c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40fafe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004698bc
jmp 0x40fbc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40fb82
lea edx, [esp + 0x7c]
push 0x763d6c
push edx
call fcn.004593e4
add esp, 8
test eax, eax
je 0x40fb82
lea eax, [esp + 0x7c]
push 0x763d68
push eax
call fcn.004593e4
add esp, 8
test eax, eax
je 0x40fb82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fb12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004698bc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4103c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x410422
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc