joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c5a9
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x40c653
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40c607
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0040c715
add esp, 0xc
jmp 0x40c64e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 1
push 0x7c52
push dword [ebp - 0x28]
push 1
push 0x681d
push dword [ebp - 0x2c]
push 0x70e6
push dword [ebp - 0x30]
push 0
push 0x58a
push 0x5c16
push 0x1c1b
call fcn.0040aa97
add esp, 0x30
jmp 0x40c711
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x40c709
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x40c6bf
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x40c6bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x40c707
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x40c6ed
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x40c707
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x68]
call fcn.0043084e
and dword [eax], 0
jmp 0x40c6e2
jmp 0x40c711
push 0
call fcn.00415402
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d9e9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40da15
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00417058
add esp, 0xc
jmp 0x40da8e
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x40da79
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x40da5b
push 0
push 0x13fa
push 0
push 0
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40da77
mov byte [ebp - 1], 0
push 0x1a6
push 0
lea eax, [ebp - 1]
push eax
push 0x16b6
call fcn.0040f28d
add esp, 0x10
jmp 0x40da8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0
push 0
call fcn.00411430
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4135b1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41363b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x413611
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4135fe
push 0x206a
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x41360f
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x413639
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0x2b9b
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 1
push 0x3abb
call fcn.004123b9
add esp, 0x18
jmp 0x413663
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 1
push 0x2062
push 0x5825
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
call fcn.0040a822
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x422f6b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x422fb9
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00423060
add esp, 0x18
jmp 0x42305c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x422fff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 1
call fcn.00420e45
add esp, 0xc
jmp 0x42305c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x42303b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x423039
push 0
push 0x13fa
push 0
push 0
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x42305c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x42305c
push 0x1956
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esp, ebp
pop ebp
ret
Function at 0x439d3a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x439d9c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x1c], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push 1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0044739e
add esp, 0x24
jmp 0x439e61
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x439e3b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x439e33
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x439e14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x439e31
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.0043084e
mov dword [eax], 0x91df82
jmp 0x439e09
jmp 0x439e39
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x439e61
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 0
push dword [ebp - 0x54]
push 0x7f5f
push dword [ebp - 0x58]
push 0xe47
call fcn.00449d75
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43a8d9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43a9d7
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43a981
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43a951
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43a94f
push 0
call fcn.0044731b
pop ecx
jmp 0x43a97f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43a97f
push 0
push 0x13fa
push 0
push 0
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x43a9d5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
push 0x6187
push 0x259d
push 0x2dea
push dword [ebp - 0x38]
push 0x2951
push 1
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0x5533
push dword [ebp - 0x44]
push 1
push 1
push dword [ebp - 0x48]
call fcn.004387e8
add esp, 0x34
jmp 0x43a9ef
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
push 0x3868
push dword [ebp - 0x4c]
push 1
call fcn.0043971b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x445dfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x445e3e
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x11da
push 0x5030
push dword [ebp - 8]
push 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x3536
call fcn.0044ff36
add esp, 0x18
jmp 0x445ebf
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x445e7f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 1
push 0x6833
push 0x5914
call fcn.004351bb
add esp, 0x10
jmp 0x445ebf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x445ea8
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x445ebf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x44af79
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44b087
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44afb4
push 0x5034
push 1
call fcn.0044b0a6
pop ecx
pop ecx
jmp 0x44b085
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44b068
mov dword [ebp - 0x18], 0x8f3d4210
push 2
lea ecx, [ebp - 0x28]
call fcn.00430760
mov dword [ebp - 0x1c], 0x3b7c39c9
mov dword [ebp - 8], 0
jmp 0x44aff0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x44b009
push dword [ebp - 8]
lea ecx, [ebp - 0x28]
call fcn.0043084e
mov dword [eax], 0x157736d0
jmp 0x44afe9
push 0
lea eax, [ebp - 0x18]
push eax
push 0x7835
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x5531
push 0x2167
push 0
push 0x18fa
push 1
call fcn.00450ddc
add esp, 0x2c
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x6e6d
push 0x58af
push 0
push 0xdc0
push 1
push 0
call fcn.0045754f
add esp, 0x1c
lea ecx, [ebp - 0x28]
call fcn.00430832
jmp 0x44b085
push 0
push 0
push 0
push 0
push 0xb3b
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x44b0a2
push 0
push 0x3c44
push 1
push 0x1277
push 0x115a
call fcn.00437ad6
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x485036
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x49a1d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ad6c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00480dcf
mov dword [ebp - 0x14], eax
cmp dword [0xaab6ec], esi
jne 0x49a2cb
push 0x800
push esi
push 0xaa144c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49a258
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49a3ab
push esi
push esi
push 0xaa144c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49a3ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49a3ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaab6ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaab6f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaab6f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaab6fc], eax
test eax, eax
je 0x49a2c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaab6f8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x49a2f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49a2e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x49a305
push 4
pop eax
jmp 0x49a3ad
cmp dword [ebp - 0x14], esi
je 0x49a305
push dword [0xaab6ec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x49a2ea
mov eax, dword [0xaab6f8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49a363
cmp dword [0xaab6fc], edi
je 0x49a363
push eax
call ebx
push dword [0xaab6fc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49a363
test eax, eax
je 0x49a363
call ecx
test eax, eax
je 0x49a358
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49a358
test byte [ebp - 8], 1
jne 0x49a363
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49a393
mov eax, dword [0xaab6f0]
cmp eax, edi
je 0x49a390
push eax
call ebx
test eax, eax
je 0x49a390
call eax
mov esi, eax
test esi, esi
je 0x49a390
mov eax, dword [0xaab6f4]
cmp eax, edi
je 0x49a390
push eax
call ebx
test eax, eax
je 0x49a390
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaab6ec]
call ebx
test eax, eax
je 0x49a3ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x49a3ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fedb
mov esp, ebp
pop ebp
ret
Function at 0x4013f6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4b06f0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.0046fe20
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
mov ecx, dword [ebp + 0x94]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0046f33a
add ebp, 0x98
leave
ret

Function at 0x401862
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1f8c]
mov eax, 0x200c
call fcn.0046f7a0
mov eax, dword [0x4b06f0]
xor eax, ebp
mov dword [ebp + 0x1f88], eax
cmp dword [0x4d2e8c], 1
mov eax, dword [ebp + 0x1f94]
mov dword [ebp - 0x7c], eax
jne 0x401946
push esi
xor esi, esi
cmp word [0x4d2478], si
je 0x401934
push edi
xor eax, eax
push 0x1ffe
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.0046fe20
push str.SerialNumber.txt
push 0x104
mov edi, 0x4d2478
push edi
mov dword [ebp - 0x80], esi
call fcn.0046ef44
add esp, 0x18
push esi
push 2
push 4
push esi
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401933
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push str._s___X__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push ebx
push dword [ebp - 0x7c]
push str._s___X_
call fcn.00403ec1
add esp, 0xc
pop esi
push dword [ebp - 0x7c]
push 0x400
push 0x4d2688
call fcn.00470452
mov ecx, dword [ebp + 0x1f88]
xor ecx, ebp
add esp, 0xc
mov dword [0x4d2680], ebx
call fcn.0046f33a
add ebp, 0x1f8c
leave
ret
Function at 0x402a66
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x4b06f0]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x200]
lea esi, [ebp + 0x1f0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x2c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x204]
lea ebx, [ebp - 0x1c]
mov dword [ebp - 0x7c], eax
movsd dword es:[edi], dword [esi]
call fcn.0040131d
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
push 0x20019
xor edi, edi
push edi
mov eax, ebx
push eax
push closesocket
mov dword [ebp - 0x78], 0x44
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x402b42
cmp dword [ebp - 0x74], edi
jne 0x402aea
xor eax, eax
jmp 0x402b0a
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.00470be0
mov eax, esp
push esi
push dword [ebp - 0x74]
push eax
call fcn.00401000
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push edi
push edi
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x70]
call fcn.00401835
cmp esi, edi
jne 0x402b42
mov eax, dword [ebp - 0x7c]
cmp eax, edi
je 0x402b42
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0x2c], ecx
mov eax, esi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1e4]
xor ecx, ebp
call fcn.0046f33a
add ebp, 0x1e8
leave
ret
Function at 0x402ed0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x2a4
mov eax, dword [0x4b06f0]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
lea esi, [ebp + 0x22c]
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str._SerialNumber_SetMasterVersion
xor ebx, ebx
movsd dword es:[edi], dword [esi]
call fcn.00401862
sub esp, 0xc
lea esi, [ebp - 0x70]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
call fcn.0040125d
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x403078
sub esp, 0x10
lea esi, [ebp - 0x70]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 0x1a0]
movsd dword es:[edi], dword [esi]
call fcn.0040114c
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1a0]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x40306f
movzx eax, byte [ebp + 0x23c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov dword [ebp - 0x78], eax
pop edi
cmp byte [ebp + 0x23c], bl
je 0x402fbd
push edi
lea eax, [ebp - 0x78]
push eax
push edi
push ebx
push 0x4a7130
push dword [ebp - 0x74]
call esi
jmp 0x402fcb
push 0x4a7130
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx eax, byte [ebp + 0x240]
mov dword [ebp - 0x78], eax
cmp byte [ebp + 0x240], bl
je 0x402ff0
push edi
lea eax, [ebp - 0x78]
push eax
push edi
push ebx
push 0x4a7134
push dword [ebp - 0x74]
call esi
jmp 0x402ffe
push 0x4a7134
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx eax, byte [ebp + 0x244]
mov dword [ebp - 0x78], eax
cmp byte [ebp + 0x244], bl
je 0x403023
push edi
lea eax, [ebp - 0x78]
push eax
push edi
push ebx
push 0x4938ec
push dword [ebp - 0x74]
call esi
jmp 0x403031
push 0x4938ec
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx eax, byte [ebp + 0x248]
mov dword [ebp - 0x78], eax
cmp byte [ebp + 0x248], bl
je 0x403056
push edi
lea eax, [ebp - 0x78]
push eax
push edi
push ebx
push 0x4a712c
push dword [ebp - 0x74]
call esi
jmp 0x403064
push 0x4a712c
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4a7138
mov ebx, esi
call fcn.00401862
pop ecx
mov ecx, dword [ebp + 0x220]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f33a
add ebp, 0x224
leave
ret 0x20