joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b25f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3b61bac
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x3b77140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CTiltleTranslate.0
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x11
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xa
lea edi, [esi + 0x1c]
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.03b58f10
lea ebx, [esi + 0x2c]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.03b58f10
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.03b58f10
mov eax, dword [ebp + 0xc]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.03b29b40
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, ebx
call fcn.03b29b40
mov edi, dword [ebp + 0x14]
push edi
lea ecx, [esi + 0x3c]
call fcn.03b29b40
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x4c], eax
cmp eax, ecx
jbe 0x3b25fc7
mov dword [esi + 0x4c], ecx
mov edi, dword [edi + 4]
mov eax, esi
cmp dword [esi + 0x4c], edi
jbe 0x3b25fd4
mov dword [esi + 0x4c], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x3b29280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x3b292d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x3b292d0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x3b292d5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x3b292bb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x3b292e2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x3b2a8a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x3b2a8e1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b2a8e3
mov esi, edi
test esi, esi
je 0x3b2a958
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b2a94d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x3b2a94d
cmp dword [esp + 0x1c], eax
jbe 0x3b2a91e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b2a94d
cmp esi, edi
je 0x3b2a93f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x3b2a958
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x3b2a970
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x3b2a9cf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x3b2a9cf
cmp dword [esp + 0xc], 3
jne 0x3b2a9cf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x3b2a9cf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x3b2a9cf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x3b2a9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov ecx, dword [esp + 0xc]
push ebp
push esi
test ecx, ecx
push edi
je 0x3b2aa17
lea edx, [esp + 0x10]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b2aa19
mov esi, ebx
test esi, esi
je 0x3b2aaa2
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3b2aa97
cmp dword [esp + 0x1c], 3
jne 0x3b2aa97
mov edx, dword [esp + 0x18]
push edx
call fcn.03b2bcab
mov edi, eax
add esp, 4
test edi, edi
je 0x3b2aa97
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3b2aa8e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp esi, ebx
mov dword [ecx], edx
je 0x3b2aa84
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edi
call fcn.03b2b765
add esp, 4
cmp esi, ebx
je 0x3b2aaa2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x3b2aab0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x3b60fdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x3b63300]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x3b2ab1b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b2ab1d
mov esi, edi
test esi, esi
je 0x3b2abe7
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3b2abdc
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x3b2ab5f
cmp eax, 2
je 0x3b2ab5f
cmp eax, 6
je 0x3b2ab5f
cmp eax, 7
jne 0x3b2abdc
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.03b2bcab
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x3b2abc2
lea ecx, [esp + 0x14]
call fcn.03b27b50
cmp esi, dword [esp + 0x14]
je 0x3b2abb7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.03b2b765
add esp, 4
jmp 0x3b2abf9
call fcn.03b2b765
add esp, 4
lea ecx, [esp + 0x10]
push 0x3b85054
call fcn.03b27b50
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x3b2abe7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x3b2abf9
push eax
lea ecx, [esp + 0x14]
call fcn.03b27b50
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.03b272b0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.03b27960
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x3b2ae40
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x3b2aed5
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x3b2ae8f
call fcn.03b2b650
test eax, eax
je 0x3b2ae8f
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x3b2ae7c
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x3b2ae7c
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x3b2ae88
add edi, ebx
mov ebx, 0x10004
jmp 0x3b2ae91
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x3b2af70
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x3b2aed5
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x3b2aec4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x3b2aee0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x3b2aef4
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x3b2af40
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x3b2aff0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x3b852d0]
sub esp, 0x114
test eax, eax
jne 0x3b2b13d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x3b85068
mov dword [0x3b852d0], 1
mov dword [0x3b85068], 0x114
call esi
mov edx, dword [0x3b85078]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x3b76090], eax
je 0x3b2b118
push ebx
push 0x3b85180
mov dword [0x3b85180], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x3b76f7c
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x3b852c4], eax
call edi
mov dword [0x3b852c8], eax
mov eax, dword [0x3b852c4]
test eax, eax
push 0x3b852a0
je 0x3b2b094
call eax
jmp 0x3b2b09a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x3b85184]
cmp eax, 6
jae 0x3b2b0b2
cmp eax, 5
jne 0x3b2b0c6
cmp dword [0x3b85188], 2
jb 0x3b2b0c6
cmp word [0x3b852a0], 9
jne 0x3b2b0c6
mov dword [0x3b8505c], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x3b2b0e4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x3b852cc], edx
jmp 0x3b2b0ea
mov edx, dword [0x3b852cc]
test edx, edx
je 0x3b2b118
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x3b2b118
mov ecx, dword [esp + 0x14]
mov dword [0x3b85074], ecx
push 0x3b85070
push 0x3b8506c
call fcn.03b2b4e0
add esp, 8
call fcn.03b2b150
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret

Function at 0x3b2b6a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3b77140]
jne 0x3b2b6aa
repz ret
jmp fcn.03b2d8c4
Function at 0x3b39e4d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.03b2eb56
and dword [ebp - 4], 0
cmp dword [0x3b85d4c], 0
mov ebx, eax
jne 0x3b39efe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x3b39faf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3b64cec
push edi
call esi
test eax, eax
je 0x3b39faf
push eax
call fcn.03b2eae4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x3b85d4c], eax
call esi
push eax
call fcn.03b2eae4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x3b85d50], eax
call esi
push eax
call fcn.03b2eae4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x3b85d54], eax
call esi
push eax
call fcn.03b2eae4
pop ecx
mov dword [0x3b85d5c], eax
test eax, eax
je 0x3b39efe
push 0x3b64c94
push edi
call esi
push eax
call fcn.03b2eae4
pop ecx
mov dword [0x3b85d58], eax
mov eax, dword [0x3b85d58]
cmp eax, ebx
je 0x3b39f56
cmp dword [0x3b85d5c], ebx
je 0x3b39f56
push eax
call fcn.03b2eb5f
push dword [0x3b85d5c]
mov esi, eax
call fcn.03b2eb5f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x3b39f56
test edi, edi
je 0x3b39f56
call esi
test eax, eax
je 0x3b39f4d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x3b39f4d
test byte [ebp - 0xc], 1
jne 0x3b39f56
or dword [ebp + 0x10], 0x200000
jmp 0x3b39f8f
mov eax, dword [0x3b85d50]
cmp eax, ebx
je 0x3b39f8f
push eax
call fcn.03b2eb5f
pop ecx
test eax, eax
je 0x3b39f8f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x3b39f8f
mov eax, dword [0x3b85d54]
cmp eax, ebx
je 0x3b39f8f
push eax
call fcn.03b2eb5f
pop ecx
test eax, eax
je 0x3b39f8f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x3b85d4c]
call fcn.03b2eb5f
pop ecx
test eax, eax
je 0x3b39faf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x3b39fb1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3b3f500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push str._s_s
push ecx
call fcn.03b2bf81
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push 0x80000002
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x3b3f5da
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x3b3f5c0
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.03b2bcab
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x3b3f5c0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x3b3f5f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push str._s_s
push ecx
call fcn.03b2bf81
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push 0x80000002
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x3b3f689
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x3b3f6a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x3b3f73a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x3b3f724
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.03b2bcab
mov esi, eax
add esp, 4
test esi, esi
je 0x3b3f724
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x3b44980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x3b6163c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x3b63300]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x3b63300]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x3b63300]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.03b58f10
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x3b64fc0
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.03b27b50
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x3b44a23
push eax
mov ecx, ebp
call fcn.03b27b50
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x3b44a41
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.03b27b50
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x3b469e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.03b2d0e0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x3b46a29
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x3b46a29
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x3b77bc0
call fcn.03b59812
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.03b35d6c
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x3b46b3b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x3b46b3b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x3b46b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x3b46b3b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x3b46b3b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.03b2d0e0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x3b46b3b
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.03b2bf20
add esp, 8
test eax, eax
je 0x3b46b3b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3b472e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x3b50030
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x3b51940
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x3b519a0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret