joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446d50
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47a673
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046dae0
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00473179
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00474695
test eax, eax
je 0x446e6c
mov ecx, dword [esp + 0x3c]
call fcn.004731a6
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x446e30
push edi
mov ecx, esi
call fcn.0047080e
mov ecx, esi
call fcn.00446fd0
cmp dword [esp + 0x38], 1
jne 0x446e65
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00470949
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x449880
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4498b3
push esi
call fcn.0044c980
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4498ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x449939
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x449922
mov eax, dword [esi + 8]
test eax, eax
je 0x4498d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44991e
cmp eax, 2
je 0x449922
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4498ca
cmp eax, 3
je 0x4498fd
cmp eax, 1
jne 0x4498ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4498ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4498ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00449960
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x449948
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00449960
add esp, 4
pop esi
ret

Function at 0x456f10
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x456fb3
test eax, eax
jbe 0x456fb3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x456fb3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x456f5e
xor esi, esi
jmp 0x456f64
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x456f8f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040a330
add esi, eax
push esi
mov ebx, esi
call fcn.0040a330
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x456f70
pop ebp
test edi, edi
pop edi
jne 0x456fb3
test ebx, ebx
je 0x456fb3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045d080
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4570f5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45720d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45720d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046df32
mov esi, eax
test esi, esi
je 0x45720d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45720d
mov ecx, esi
call fcn.00457060
cmp edi, eax
jge 0x45720d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x457193
mov dword [esp + 0x34], 1
jmp 0x4571ee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45720d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00455870
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46e8d6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46e90e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046c963
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046c93b
jmp 0x46e91a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46ffcb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47000d
call fcn.00475a80
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47000d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x470004
xor eax, eax
jmp 0x470015
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047001b
pop edi
pop esi
pop ebx
ret 4
Function at 0x475fb0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475fde
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475ffc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475f16
jmp 0x475ffc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475ffc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00475f16
test edi, edi
mov eax, edi
jne 0x475fe6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Execute syscall

Disassembly:
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.0040c1d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword fs:[0xc0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x401148
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
int 0x2e
ret
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call dword fs:[0xc0]
ret
Function at 0x405500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x20006
push str.SoftwareMicrosoftATLSamplesGUIDGen
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00405d10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405676
push 0x20006
push str.SoftwareMicrosoft
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00405d10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405676
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push 0
push 0x20006
push 0
push 0
push 0x44c958
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00404520
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40566e
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
push 0
push 0x20006
push 0
push 0
push str.Samples
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404520
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405666
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
push 0
push 0
push 0x20006
push 0
push 0
push str.GUIDGen
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x48]
call fcn.00404520
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x24], 0
je 0x40563d
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0x20006
push str.SoftwareMicrosoftATLSamplesGUIDGen
push 0x80000001
lea ecx, [ebp - 0x24]
call fcn.00405d10
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x48]
call fcn.00401d20
lea ecx, [ebp - 0x30]
call fcn.00401d20
lea ecx, [ebp - 0x3c]
call fcn.00401d20
cmp dword [ebp - 4], 0
jne 0x4056a8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x40568b
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push 0
push str.GUID_Type
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
movzx eax, word [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
call fcn.00401d20
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405b40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x47bd14]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x308], ecx
mov ecx, dword [ebp - 0x308]
call fcn.00409fe0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x405bba
push 0xff
lea edx, [ebp - 0x104]
push edx
push 0x7d1
mov eax, dword [0x47ca38]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push str.GUIDGen
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x405c5a
lea ecx, [ebp - 0x304]
push ecx
mov ecx, dword [ebp - 0x308]
call fcn.00404a00
lea edx, [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x405c52
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x314], eax
mov edx, dword [ebp - 0x310]
push edx
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp - 0x314]
push ecx
call fcn.00412840
add esp, 0xc
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x30c]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d9dd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4068a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x47bd14]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x114]
call fcn.00405d10
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x406930
mov edx, dword [ebp - 0x108]
mov dword [ebp - 0x120], edx
lea ecx, [ebp - 0x114]
call fcn.00401d20
mov eax, dword [ebp - 0x120]
jmp 0x406a14
mov dword [ebp - 0x11c], 0x100
lea eax, [ebp - 0x134]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4069b4
lea ecx, [ebp - 0x104]
push ecx
lea ecx, [ebp - 0x114]
call fcn.004068a0
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x4069a8
mov edx, dword [ebp - 0x108]
mov dword [ebp - 0x124], edx
lea ecx, [ebp - 0x114]
call fcn.00401d20
mov eax, dword [ebp - 0x124]
jmp 0x406a14
mov dword [ebp - 0x11c], 0x100
jmp 0x40693a
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x114], 0
je 0x4069e4
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x118]
call fcn.00404610
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x114]
call fcn.00401d20
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d9dd
mov esp, ebp
pop ebp
ret 4

Function at 0x406af0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x406b4f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x406b1c
mov eax, 1
jmp 0x406b6d
push str.RegDeleteKeyTransactedA
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406b4d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x406b6d
jmp 0x406b68
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x406b68
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x406b6d
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x409910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x409919
cmp dword [ebp + 0xc], 0
je 0x40992c
mov dword [ebp - 0x10], 1
jmp 0x409933
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x409946
mov eax, 0xd
jmp 0x40999d
xor edx, edx
jne 0x40991d
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041ce60
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 1
jne 0x409957
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 7
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8
Function at 0x436640
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00435e1a

Function at 0x43664b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00436055

Function at 0x4376d3
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043745a
Function at 0x405fcc
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.004057a4
mov dword [0x40b6ec], eax
cmp dword [0x40b6ec], 0
je 0x40606d
cmp dword [0x40b6fc], 0
je 0x40606d
cmp dword [0x40b700], 0
je 0x40606d
mov eax, dword [0x40b6ec]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40b6ec]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x406054
push esi
lea esi, [esp + 4]
mov edi, 0x40b704
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x40b6fc]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40b6ec]
push eax
call sub.kernel32.dll_SetThreadContext
mov eax, dword [0x40b6ec]
push eax
call sub.kernel32.dll_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret
Function at 0x406318
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40655b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x406568
mov edx, 0x406578
mov eax, 0x80000002
call fcn.004051dc
cmp dword [ebp - 8], 0
je 0x406530
mov edx, dword [ebp - 8]
mov eax, 0x4065c8
call fcn.00403644
test eax, eax
je 0x4063aa
lea edx, [ebp - 8]
mov ecx, 0x7fffffff
xchg edx, eax
call fcn.004035fc
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.0040464c
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
call fcn.004031b4
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x4065d4
mov edx, dword [ebp - 8]
call fcn.004033a8
mov eax, dword [ebp - 0x150]
call fcn.0040355c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040311c
cmp esi, 0xffffffff
setne al
jmp 0x406522
mov bl, byte [ebp - 0x11c]
cmp bl, 0x30
jb 0x406416
cmp bl, 0x39
jbe 0x406444
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403344
mov eax, dword [ebp - 0x154]
mov edx, 0x4065e4
call fcn.004046c8
test eax, eax
jne 0x40650f
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403344
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.004033a8
mov eax, dword [ebp - 0x158]
call fcn.0040355c
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x406509
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403344
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 4]
call fcn.0040474c
mov eax, dword [ebp - 4]
call fcn.00406840
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403344
mov eax, dword [ebp - 0x164]
mov edx, 0x4065e4
call fcn.004046c8
test eax, eax
jne 0x40650f
lea edx, [ebp - 0x168]
mov eax, 0x406600
call fcn.0040474c
mov eax, dword [ebp - 0x168]
call fcn.00406840
jmp 0x40650f
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x406406
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406562
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.00403140
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403140
ret