joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5299b3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cea3
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529ad6
push ecx
lea ecx, [esi + 0x18]
call fcn.005491d3
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529aed
push ecx
lea ecx, [esi + 0x24]
call fcn.005490e3
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x572fc3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a64b3
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5730e6
push ecx
lea ecx, [esi + 0x18]
call fcn.005927e3
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5730fd
push ecx
lea ecx, [esi + 0x24]
call fcn.005926f3
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bc923
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efe13
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bca46
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc143
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bca5d
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc053
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5db0b8
Capabilities:
Encode data using xor

Disassembly:
adc byte [edx], 0xe4
daa
inc eax
in eax, 0x4e
test byte [esi], dh
sbb dh, byte [esi]
or ecx, esp
push ss
lock adc byte [esi - 0x347884d4], dl
mov al, 0xbf
lodsb al, byte [esi]
add ebp, ecx
dec edi
and byte [bx - 0x1f], 0xe8
and edi, esp
test dword [ecx], ebx
sub al, 0xc6
inc ebp
adc esi, dword [0x1625f4f0]
aaa
nop
mov dword [0x43ec401e], eax
cmpsd dword [esi], dword es:[edi]
inc esi
cmpsd dword [esi], dword es:[edi]
aaa
nop
mov byte [0xc89b674], al
invalid
ja 0x5db04a
js 0x5db102
int1
mov ecx, 0xb39ab1
mov cl, 0xa7
xchg ebp, eax
mov al, 0xa6
mov byte [0x25f665cb], al
dec esp
pop esi
daa
push esp
popfd
mov ch, 0x13
mov dword [edi + 0x2641c7c], eax
mov eax, 0xaff4e4c0
not dword [edx - 0x7477f8d1]
adc ah, byte [ebx - 0x17361d1a]
jne 0x5db14d
lea eax, [esi]
push cs
dec esp
adc ebx, eax
insb byte es:[edi], dx
fld st(4)
salc
daa
mov edx, 0xa3fe269b
shl dword [edi + 0x49adf1c5], 0x75
int1
lodsd eax, dword [esi]
dec ecx
jne 0x5db08b
sbb byte [ebp - 0x362afa9e], ah
xchg esi, eax
stc
invalid
xor dh, al
dec esp
outsd dx, dword [esi]
in eax, 0xe0
or dl, byte [esi]
mov cl, 0x56
cmp ecx, dword [edi - 0x7428c421]
jecxz 0x5db0f6
xor dword [ebp + eax - 0x6b74037b], 0xffffffbd
cmpsd dword [esi], dword es:[edi]
inc ebp
cmp byte [edx + 0x29], al
invalid
or cl, 0x16
out 0x37, al
pop ecx
aas
xor eax, 0x207ff238
idiv byte [ecx + 0x1b]
adc dword [eax + 0x33], ebx
dec ecx
and al, 0xfa
out dx, eax
in al, 0xab
retf
lea esi, [edx + ebx*8 - 0x3b]
jo 0x5db132
fist word [ebx]
cmp al, 0x17
adc edi, dword [edi + edx]
in al, 0xf7
inc ecx
or eax, 0x5562d76c
imul edx, dword [eax], 0xffffffd9
in al, dx
in eax, dx
mov ah, 0x31
adc bh, 0x97
stc
pop ebp
outsb dx, byte [esi]
scasd eax, dword es:[edi]
loopne 0x5db152
inc esp
xchg dword [eax + ebx*2 - 0x1c], edi
xchg ecx, eax
xor ebp, dword [eax + 0x1022415b]
inc edi
loope 0x5db1f9
invalid
sti
push ss
xor dword [edx], esi
ret 0x3f7c

Function at 0x5db483
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
dec ecx
adc al, 0x61
push ebp
and edi, ebp
cmpsb byte [esi], byte es:[edi]
push ss
imul esp, dword [ebx - 0x57], 0x43acd3f4
pop edx
or ecx, dword [edx + 5]
mov edx, dword [eax + 0xa]
insd dword es:[edi], dx
aam 0x90
xor dword [esi], esi
mov byte [0xa4d0f6af], al
lodsd eax, dword [esi]
div byte [ebp - 0x2aeb707a]
invalid

Function at 0x627873
Capabilities:
Encode data using xor

Disassembly:
pop esi
mov byte [0x461ceb99], al
dec esp
push ds
in eax, dx
salc
aaa
fimul dword gs:[ecx - 0x24334cc]
adc al, 0x4b
mov word [edx - 0x1ac83d48], ds
inc ebp
scasd eax, dword es:[edi]
xchg ecx, eax
xor al, 0xb8
pop eax
jge 0x627874
xchg ebp, eax
and byte [eax + 0x16c80192], bh
test byte [ebp - 0x6a], 0x8f
ror esp, 1
invalid
Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d22a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dfd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6526d4
push edi
call fcn.0064fea0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064db40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064db50
lea eax, [ebp - 0xa0]
push 0x6526b4
push eax
call fcn.0064db50
push dword [esi + 0x65433c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064db50
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x403f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x403f33
push dword [ebp + 8]
call sub.user32.dll_IsWindowVisible
jmp 0x403f49
push 0
push dword [ebp + 8]
call sub.user32.dll_ShowWindow
push 0x9c40
call fcn.00403ee4
xor eax, eax
push eax
push 0x420cfc
push 0x422500
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x422500
push str.Visible
push str.SoftwareRSC_ProductsRSNetMonSettings
push 0x80000001
call fcn.00414ced
leave
ret 8

Function at 0x404209
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push 0x100
push dword [ebp + 8]
push dword [0x41df3a]
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x404299
mov edi, eax
push eax
push dword [0x41df3a]
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 4], eax
push edi
push dword [0x41df3a]
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x404299
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 2
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 4]
push esi
push edi
call sub.kernel32.dll_RtlMoveMemory
xor eax, eax
jmp 0x40427b
xor byte [eax + edi], 0xaa
inc eax
cmp eax, dword [ebp - 4]
jl 0x404276
push edi
call fcn.00405890
push 0x8000
push 0
push edi
call sub.kernel32.dll_VirtualFree
pop esi
pop edi
leave
ret 4
xor eax, eax
pop esi
pop edi
leave
ret 4

Function at 0x4046eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
cmp dword [0x41e06b], 0
jne 0x404717
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x40510f
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
pop esi
leave
ret

Function at 0x404b02
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x420d34], 3
jb 0x404b28
push 1
push 0
push str._ncpa.cpl
push 0x41e54d
push 0
push dword [ebp + 8]
call sub.shell32.dll_ShellExecuteA
jmp 0x404b40
push 1
push 0
push str._Netcpl.cpl
push str.CONTROL.EXE
push 0
push dword [ebp + 8]
call sub.shell32.dll_ShellExecuteA
leave
ret 4
Function at 0x405630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push esi
cmp dword [0x41e087], 0
je 0x40565c
push 0x4224f0
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_CopyRect
mov edi, 0
mov esi, dword [0x41e0af]
jmp 0x405675
push 0x4224e0
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_CopyRect
mov edi, 1
mov esi, dword [0x41e0ab]
push 0x24
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [ebp + 8]
call sub.user32.dll_SetWindowPos
push 0x3e8
push dword [ebp + 8]
call fcn.0041420b
push edi
push eax
call sub.user32.dll_ShowWindow
push 0x3f8
push dword [ebp + 8]
call fcn.0041420b
push edi
push eax
call sub.user32.dll_ShowWindow
push 0x3f2
push dword [ebp + 8]
call fcn.0041420b
push edi
push eax
call sub.user32.dll_ShowWindow
push 0x3ed
push dword [ebp + 8]
call fcn.0041420b
push 5
push 0
push 0
push esi
push dword [0x41e0a7]
push 0
push eax
call sub.user32.dll_SetWindowPos
push dword [0x41e087]
push 0x420cfc
push 0x422500
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x422500
push str.SmallSize
push str.SoftwareRSC_ProductsRSNetMonSettings
push 0x80000001
call fcn.00414ced
pop esi
pop edi
leave
ret 4

Function at 0x405722
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, 0xffffffff
cmp dword [0x420d34], 3
jb 0x40578e
lea eax, [ebp - 4]
push eax
push 0x28
push dword [ebp + 8]
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x14], 1
xor eax, eax
cmp dword [ebp + 0xc], 0
je 0x405768
mov eax, 2
mov dword [ebp - 8], eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
push eax
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop eax
leave
ret 8

Function at 0x40581d
Capabilities:
Get graphical window text
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
call fcn.00413fdf
cmp eax, 2
jbe 0x405874
call sub.kernel32.dll_GetCurrentProcess
mov edx, eax
lea eax, [ebp - 4]
push eax
push 0x28
push edx
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 0
push 0x10
push dword [0x41df3e]
call sub.user32.dll_SendMessageA
push 0
push 0xd
call sub.user32.dll_ExitWindowsEx
leave
ret
Function at 0x40abf8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
mov edi, dword [0x4211e8]
cmp dword [edi + 8], 0
je 0x40ac2f
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
call sub.kernel32.dll_GetExitCodeThread
push dword [ebp - 4]
push dword [edi + 8]
call sub.kernel32.dll_TerminateThread
push dword [edi + 8]
call sub.kernel32.dll_CloseHandle
add edi, 0x10
jmp 0x40ac05
push dword [0x4211e8]
call sub.kernel32.dll_GlobalFree
mov dword [0x4211ec], 0
mov edi, dword [0x4211e4]
inc edi
cmp dword [edi], 0
je 0x40ac63
push dword [edi]
call fcn.0041359c
push dword [edi]
call sub.user32.dll_DestroyWindow
add edi, 4
jmp 0x40ac4b
push dword [0x4211bc]
call fcn.0040bf3b
mov dword [0x4211bc], 0
cmp dword [0x4211d8], 0
je 0x40ac9d
push 0x8000
push 0
push dword [0x4211d8]
call sub.kernel32.dll_VirtualFree
mov dword [0x4211d8], 0
mov edi, dword [0x421170]
cmp dword [edi + 4], 0
je 0x40acbf
push 0x8000
push 0
push dword [edi + 4]
call sub.kernel32.dll_VirtualFree
mov dword [edi + 4], 0
push dword [0x4211c4]
call fcn.0040a089
push dword [0x4211c8]
call fcn.0040a089
push 0x104
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push 0x421f8c
call fcn.0040ea2f
push edi
push str.EC2RUNDIALOGBOX
call fcn.0040ea2f
push edi
push 0x421fa4
call fcn.0040ea2f
push edi
push 0x421fb4
call fcn.0040ea2f
push edi
push str.EC2RUNWINDOW
call fcn.0040ea2f
push edi
push str.EC2RUNMDICHILDWINDOW
call fcn.0040ea2f
push edi
push str.EC2RUNMDIWINDOW
call fcn.0040ea2f
push edi
call sub.kernel32.dll_GlobalFree
pop edi
leave
ret
Function at 0x40ca97
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push esi
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
xor edi, edi
lea esi, [ebp - 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 3
push esi
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x40caf7
cmp word [esi], 0xbbef
jne 0x40caf7
cmp byte [esi + 2], 0xbf
jne 0x40caf7
cmp dword [ebp - 4], 3
jae 0x40caf2
mov dword [ebp - 4], 3
mov edi, 1
push 0
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, edi
pop esi
pop edi
leave
ret 4

Function at 0x40d7e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
mov eax, dword [ebp + 0xc]
xor edi, edi
and ax, 0xe0
cmp ax, 0xc0
jne 0x40d805
mov edi, 1
jmp 0x40d817
mov eax, dword [ebp + 0xc]
and ax, 0xf0
cmp ax, 0xe0
jne 0x40d817
mov edi, 2
or edi, edi
jne 0x40d826
mov eax, 0xffffffff
pop esi
pop edi
leave
ret 8
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp + 0xc]
xor edx, edx
lea esi, [ebp - 8]
mov ah, byte [edx + esi]
inc edx
xchg ah, al
mov cx, ax
and ch, 0xe0
cmp ch, 0xc0
jne 0x40d87a
and cl, 0xc0
cmp cl, 0x80
jne 0x40d873
mov cl, al
xor al, al
and ah, 0x1f
shr ax, 2
and cl, 0x3f
or al, cl
jmp 0x40d8b3
dec edx
mov ax, 0xffff
jmp 0x40d8b3
mov ch, ah
and ch, 0xf0
cmp ch, 0xe0
jne 0x40d873
and cl, 0xc0
cmp cl, 0x80
jne 0x40d873
mov cl, al
xor al, al
and ah, 0xf
shr ax, 2
and cl, 0x3f
or al, cl
mov cl, byte [edx + esi]
mov ch, cl
and ch, 0xc0
cmp ch, 0x80
jne 0x40d873
inc edx
and cl, 0x3f
shl ax, 6
or al, cl
pop esi
pop edi
leave
ret 8
Function at 0x40d8b9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push ecx
push edx
push edi
push esi
push 0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x40d8dd
mov word [eax], 0
xor esi, esi
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x40d8f7
mov esi, 1
mov ebx, dword [ebp + 0xc]
or ebx, ebx
jne 0x40d900
mov edi, eax
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
call fcn.0040ca97
mov dword [ebp - 0xc], eax
or eax, eax
je 0x40d91d
mov dword [ebp + 0x10], 1
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x40da70
mov word [ebp - 0xe], 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x40da67
cmp dword [ebp - 4], 0
je 0x40da67
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
je 0x40d971
cmp dword [ebp - 0xc], 0
je 0x40d973
xor ah, ah
cmp ax, 0xd
jne 0x40d9c8
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x40d9bc
cmp dword [ebp - 4], 0
je 0x40d9bc
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
jne 0x40d9a4
xor ah, ah
cmp ax, 0xa
je 0x40d9bc
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, 1
jmp 0x40da72
cmp ax, 0xa
jne 0x40da18
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x40da11
cmp dword [ebp - 4], 0
je 0x40da11
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
jne 0x40d9f9
xor ah, ah
cmp ax, 0xd
je 0x40da11
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, 1
jmp 0x40da72
cmp dword [ebp - 0xc], 0
je 0x40da30
cmp ax, 0x7f
jbe 0x40da30
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.0040d7e7
cmp dword [ebp + 0x14], 0
je 0x40da44
cmp dword [ebp + 0xc], 0
je 0x40da3f
mov word [ebx], ax
add ebx, 2
jmp 0x40da4d
cmp dword [ebp + 0xc], 0
je 0x40da4c
mov byte [ebx], al
inc ebx
or ax, ax
je 0x40da60
mov eax, ebx
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jl 0x40d91d
mov eax, 0xffffffff
jmp 0x40da72
mov eax, 0xffffffff
jmp 0x40da72
mov eax, esi
cmp dword [ebp + 0xc], 0
je 0x40da87
mov byte [ebx], 0
cmp dword [ebp + 0x14], 0
je 0x40daa7
mov byte [ebx + 1], 0
jmp 0x40daa7
cmp eax, 0xffffffff
jne 0x40da90
mov ebx, eax
jmp 0x40da98
inc ebx
cmp dword [ebp + 0x14], 0
je 0x40da98
inc ebx
push 0
push 0
push edi
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, ebx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 0x10
Function at 0x413216
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x413318
mov dword [ebp - 8], 0x104
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x4211dc]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x4132fa
push dword [0x4211dc]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
cmp eax, 0
je 0x41323e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_lstrcpyA
push edi
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x4132ba
cmp byte [eax + edi - 1], 0x5c
je 0x4132ba
mov byte [eax + edi], 0x5c
mov byte [eax + edi + 1], 0
push dword [0x4211dc]
push edi
call sub.kernel32.dll_lstrcatA
push edi
push dword [ebp + 8]
call fcn.00413216
push eax
push edi
call fcn.0040bf3b
pop eax
or eax, eax
je 0x4132fa
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
cmp eax, 0
je 0x41323e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyA
or eax, eax
jne 0x413318
mov eax, 1
jmp 0x41331a
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8

Function at 0x413322
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x41342b
mov dword [ebp - 8], 0x208
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x4211dc]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0x103
je 0x41340d
push dword [0x4211dc]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyW
cmp eax, 0
je 0x41334a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_lstrcpyW
push edi
call sub.kernel32.dll_lstrlenW
or eax, eax
je 0x4133cd
shl eax, 1
cmp word [eax + edi - 2], 0x5c
je 0x4133cd
mov word [eax + edi], 0x5c
mov word [eax + edi + 2], 0
push dword [0x4211dc]
push edi
call sub.kernel32.dll_lstrcatW
push edi
push dword [ebp + 8]
call fcn.00413322
push eax
push edi
call fcn.0040bf3b
pop eax
or eax, eax
je 0x41340d
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
cmp eax, 0
je 0x41334a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyW
or eax, eax
jne 0x41342b
mov eax, 1
jmp 0x41342d
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8