joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40178a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x420], 0x400
lea eax, [ebp - 0x41c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], 0x410074
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40180b
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 8], 0x410074
mov dword [esp + 4], 0x4100a7
mov dword [esp], eax
call dbg.error
mov eax, 1
jmp 0x401954
mov eax, dword [ebp - 0x41c]
lea edx, [ebp - 0x420]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x414]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4100bf
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401872
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 1
jmp 0x401954
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x4018bb
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 8], 0x4100bf
mov dword [esp + 4], str.Wrong_type_of__s_n
mov dword [esp], eax
call dbg.error
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 1
jmp 0x401954
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x414]
movzx eax, byte [eax]
test al, al
jne 0x4018e5
mov eax, 0
jmp 0x401954
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.netinfo_get_first
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401900
mov eax, 1
jmp 0x401954
mov dword [esp + 4], 0x4100dc
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym._strtok
mov dword [ebp - 0xc], eax
jmp 0x401949
mov eax, dword [ebp - 0x10]
add eax, 0x120
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.namelist_add
mov dword [esp + 4], 0x4100dc
mov dword [esp], 0
call sym._strtok
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40191b
mov eax, 0
leave
ret
Function at 0x401956
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.00408ab0
sub esp, eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2f00], eax
mov dword [ebp - 0x10], 0
mov dword [esp + 8], 0x1f42
lea eax, [ebp - 0x2ef4]
mov dword [esp + 4], eax
mov dword [esp], 0x412070
mov eax, dword [sym.imp.ole32.dll_StringFromGUID2]
call eax
sub esp, 0xc
test eax, eax
jne 0x4019c1
mov dword [esp + 4], str.Error_translate_GUID
mov dword [esp], 0
call dbg.error
mov eax, 0x80004005
jmp 0x401af9
mov dword [esp + 0x18], str.Connection
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2ef4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SYSTEMCurrentControlSetControlNetwork
mov dword [esp + 8], str._s_ws_s_s
mov dword [esp + 4], 0xfa0
lea eax, [ebp - 0xfb1]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
lea eax, [ebp - 0x2ef8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
lea eax, [ebp - 0xfb1]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401a65
lea eax, [ebp - 0xfb1]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Error_open_registry:__s
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.error
mov eax, dword [ebp - 0xc]
jmp 0x401af9
mov eax, dword [ebp - 0x2ef8]
lea edx, [ebp - 0x2f00]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x2efc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.Name
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401ae8
mov eax, dword [ebp - 0x2f00]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Error_in_work_with_registry:__u__size___u
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.error
mov eax, dword [ebp - 0x2ef8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x401af9
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402565
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x894
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x60]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.run:__s_n
call dbg.debug
mov dword [ebp - 0x60], 0x44
mov dword [esp + 0x14], 0x400
lea eax, [ebp - 0x860]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
test eax, eax
jne 0x402629
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_format__s
mov dword [esp], edx
call dbg.error
mov eax, dword [ebp - 0xc]
jmp 0x402736
lea eax, [ebp - 0x1c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x60]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x860]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessW]
call eax
sub esp, 0x28
test eax, eax
jne 0x4026b4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_exec__s
mov dword [esp], edx
call dbg.error
mov eax, dword [ebp - 0xc]
jmp 0x402736
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402733
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.failed_to_run_cmd:__s._return__d__0x_X_
mov dword [esp], 0
call dbg.error
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
leave
ret
Function at 0x403251
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20007
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40330a
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40330a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Cant_open_create_registry__s_n
mov dword [esp], eax
call dbg.error
mov eax, 1
jmp 0x4033e7
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403398
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Cant_set_registry__s_s._return__d_n
mov dword [esp], eax
call dbg.error
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 1
jmp 0x4033e7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4033d2
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Cant_flush_registry__s._return__d_n
mov dword [esp], eax
call dbg.error
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 0
leave
ret
Function at 0x4050e7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
shr ax, 8
movzx eax, al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 5
jbe 0x40512f
mov eax, 1
jmp 0x405134
mov eax, 0
leave
ret

Function at 0x405136
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x444
mov dword [esp], 0
call dbg.time
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.localtime
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._asctime
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.C:prl_nettool.log
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4051cd
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
je 0x4052d3
mov eax, 0x400
sub eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x420]
mov edx, dword [ebp - 0xc]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._s__d
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
add dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x405255
lea eax, [ebp + 0xc]
mov dword [ebp - 0x428], eax
mov edx, dword [ebp - 0x428]
mov eax, 0x400
sub eax, dword [ebp - 0xc]
lea ebx, [ebp - 0x420]
mov ecx, dword [ebp - 0xc]
add ecx, ebx
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.msvcrt.dll__vsnprintf]
call eax
add dword [ebp - 0xc], eax
mov eax, 0x400
sub eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x420]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov dword [esp + 8], 0x410ca1
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
add dword [ebp - 0xc], eax
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x420]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x424]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x420]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x407711
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 8], str.Globalprl_nettool_mutex
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [0x41605c], eax
mov eax, dword [0x41605c]
test eax, eax
jne 0x40777b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x40777b
mov dword [esp + 8], str.Globalprl_nettool_mutex
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov eax, dword [sym.imp.KERNEL32.dll_OpenMutexA]
call eax
sub esp, 0xc
mov dword [0x41605c], eax
mov eax, dword [0x41605c]
test eax, eax
jne 0x4077bc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ebx, eax
mov dword [esp], 2
mov eax, dword [sym.___acrt_iob_func]
call eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.Globalprl_nettool_mutex
mov dword [esp + 4], str.WARNING:_OpenMutex___s_____u_n
mov dword [esp], eax
call dbg.fprintf
jmp 0x407854
mov eax, dword [0x41605c]
mov dword [esp + 4], 0x3a980
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
cmp eax, 0xffffffff
je 0x4077eb
cmp eax, 0x80
je 0x4077eb
cmp eax, 0x102
je 0x40782a
jmp 0x407854
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ebx, eax
mov dword [esp], 2
mov eax, dword [sym.___acrt_iob_func]
call eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.Globalprl_nettool_mutex
mov dword [esp + 4], str.ERROR:_WaitForSingleObject___s_____u_n
mov dword [esp], eax
call dbg.fprintf
mov dword [esp], 2
call sym._exit
mov dword [esp], 2
mov eax, dword [sym.___acrt_iob_func]
call eax
mov dword [esp + 4], str.ERROR:_timeout_waiting_for_pending_operation_to_finish_n
mov dword [esp], eax
call dbg.fprintf
mov dword [esp], 2
call sym._exit
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x407d90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x407df0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x416090]
test esi, esi
jle 0x407f10
mov eax, dword [0x416094]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x407e24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x407ea7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x407e10
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x407f37
mov eax, dword [0x416094]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x416094]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x407f17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x407ea0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x407eb0
add dword [0x416090], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x416094]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x407ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x407e2e
mov eax, dword [0x416094]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop

Function at 0x408450
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4160ac
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4160a4]
sub esp, 4
test ebx, ebx
je 0x4084a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40849e
test esi, esi
je 0x40849e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x408480
mov dword [esp], 0x4160ac
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4087e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x408805
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x408810
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x408805
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x408858
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40884e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40885a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x408840
xor eax, eax
pop ebx
pop esi
ret
Function at 0x43fa03
Capabilities:
Hash data with crc32

Disassembly:
je 0x43fbf7
jne 0x43fbf7
cmp dword [0x69a7642c], esi
lea edi, [eax + 0xcd0ea8]
cmp dword [0xd0c3a8], ecx
or dword [eax + 0x20], 0x80
mov byte [eax + esi - 1], 0
cmp dword [0xdeb3d8], edi
mov dword [0x112765ac], eax
mov dword [esi], 0xace0bc
movsx eax, word [ebp - reloc.shell32.dll_SHChangeNotify]
push 0xaab9a8
int1
rcr byte [esi], 1
loop 0x43f2e7
sub eax, 0x22a93090
aaa
out 0x83, al
leave
jmp [eax + reloc.shell32.dll_ShellExecuteA]
movsd dword es:[edi], dword [esi]
add byte [eax + 0x4561b4], bh
mov eax, 0x10d7a2b8
mov edx, 0xb1ced4
push 0xa76714
mov dword [esi], 0x9fb764
push 0x4f0dcc
mov dword [edx + esi + 0x13c], 0x10261f8c
push 0x697a2e6c
mov byte [ebp - 0x132], 0
mov ecx, 0x15
sti
and bh, byte [edi + 0x4232049f]
cmp byte [eax], bl
mov al, byte [0x6b249244]
dec edi
arpl word [eax], bx
cwde
jmp 0x43fa03
not ecx
xor ebx, ebx
je 0x43fafa
jne 0x43fafa
cmp dword [ebp + 0xc], eax
jmp dword [ecx*4 + 0x86d66c]
shr ecx, 8
je 0x43f8c9
jne 0x43f8c9
mov dword [0x112b2da8], eax
neg dword [ebp + 0x12]
push 0xa233fc
push 0x1016adc0
mov dword [0x1124da0c], eax
mov dword [0x111d2de4], eax
cmp dword [ebp + 0x1c], 0x80000000
mov dword [esi], 0xa0e618
pmaddwd xmm6, xmmword [0x69809430]
mov eax, 0x10dab0f8
push 0x100d8c6c
mov ecx, dword [0x42be3c]
movzx eax, word [reloc.shell32.dll_SHChangeNotify]
add ebp, 0x518
mov dword [esi + 0x5c], 0x42edc0
push 0xaf4520
cmp byte [0xdef019], 0
mov dword [esp + 0xec], 0x1028d9a4
hlt
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
push 0x43fb85
ret
push eax
push 0x43fe3a
ret
je 0x43f33b
movzx eax, byte [esi]
xor eax, ecx
je 0x43fd59
jne 0x43fd59
mov ecx, dword [0x1152b260]
lock cmpxchg dword [ebx], edx
mov dword [esi + 0x694], 1
mov dword [esi + 4], 0x63eba0
jmp dword [0x49140c]
xor ecx, dword [eax*4 + 0x401240]
push 0x43f5f1
ret
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
jmp 0x43f814
mov dword [ebp - 0x124], esi
jmp 0x43f925
cmp ecx, 0x39b5d60d
sete bl
jmp 0x43f464
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b19b0
push 0x4a41c0
mov eax, dword fs:[0]
jmp 0x43f67a
and eax, 0xff
jmp 0x43f37a
Function at 0x6de1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006de140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006de140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006de140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006de140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6debfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6dec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6f087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6dec52
xor eax, eax
pop esi
leave
ret 4