joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405dcf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00405a21
mov byte [ebx + 0x77], al
mov ecx, ebx
lea eax, [ebp - 4]
push eax
call fcn.0040686c
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x14], edi
cmp dword [edi - 0xc], 0
je 0x405e5a
push edi
push 1
push str.EnableLogging
push str.LoggingSettings
call esi
push edi
push 1
test eax, eax
push str.ShowTime
setne al
push str.LoggingSettings
mov byte [ebx + 0x74], al
call esi
push edi
push 0
test eax, eax
push str.LogToOutputDebug
setne al
push str.LoggingSettings
mov byte [ebx + 0x76], al
call esi
push edi
push 1
test eax, eax
push str.AppendToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x78], al
call esi
test eax, eax
setne al
jmp 0x405e68
mov byte [ebx + 0x74], 1
mov al, 1
mov byte [ebx + 0x76], 1
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x79], al
cmp byte [ebx + 0x75], 0
je 0x405e75
mov byte [ebx + 0x76], 1
xor eax, eax
mov byte [ebx], 1
mov dword [ebx + 4], 7
mov edi, esi
mov dword [ebp - 4], eax
mov edx, dword [eax + 0x43cb10]
mov ecx, dword [eax + 0x43cb14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
test edx, edx
je 0x405ee1
cmp ecx, 9
ja 0x405ee1
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0040686c
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x405ec4
push esi
push 1
push dword [ebp - 0xc]
push str.LoggingLevel
call edi
jmp 0x405ec7
xor eax, eax
inc eax
mov edx, dword [ebp - 0x10]
test eax, eax
setne cl
mov byte [ebx + edx*8], cl
lea ecx, [esi - 0x10]
mov dword [ebx + edx*8 + 4], eax
call fcn.004016ae
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
cmp eax, 0x48
jb 0x405e86
call fcn.004058c7
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], edx
lea ecx, [ecx - 0x10]
call fcn.004016ae
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405f0d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea ecx, [ebp - 4]
call fcn.0040171e
mov esi, dword [ebp - 4]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x405f3d
push edx
lea ecx, [ebp - 4]
call fcn.00401901
mov esi, dword [ebp - 4]
push esi
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x405f76
mov ecx, dword [ebp + 8]
push 0x432be0
call fcn.00404067
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004040c6
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004016ae
mov eax, dword [ebp + 8]
jmp 0x405fb0
push str.BraveSoftwareUpdateLog
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x405f4f
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004018a1
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
add eax, 0x10
push 0xffffffffffffffff
mov dword [esi], eax
call fcn.004040c6
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004016ae
mov eax, esi
pop esi
leave
ret 4
Function at 0x406ee3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x406f13
xor al, al
jmp 0x406f37
cmp byte [esi + 0xb], bl
je 0x406f2e
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x433d48
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406fb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x70], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4070de
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x74]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x4070de
cmp dword [ebp - 0x78], esi
jne 0x4070de
push dword [ebp - 0x6c]
call fcn.0042a9f1
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
mov dword [ebp - 0x7c], esi
call fcn.00416d70
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x4070d3
mov edi, dword [ebp - 0x6c]
shr edi, 1
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x4070d3
cmp word [esi + edi*2 - 4], bx
jne 0x4070d3
cmp word [esi + edi*2 - 2], bx
jne 0x4070d3
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x70]
add eax, 0x14
mov edx, str.___
push eax
call fcn.004072e7
mov esi, dword [ebp - 0x70]
pop ecx
test edi, edi
je 0x4070bf
mov eax, dword [ebp - 0x7c]
push esi
lea eax, [eax + ebx*2]
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4070c2
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc ebx
add ebx, eax
cmp ebx, edi
jb 0x40709a
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [esi - 0x10]
setne bl
call fcn.004016ae
mov esi, dword [ebp - 0x7c]
push esi
call fcn.00416681
pop ecx
mov al, bl
jmp 0x4070e0
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415ff1
leave
ret
Function at 0x407279
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x407286
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4072bf
cmp eax, 0x80
je 0x4072bf
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00409508
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x407282
mov al, 1
pop esi
ret

Function at 0x408082
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
call fcn.0040894b
cmp byte [ebp - 8], 0
je 0x4080a2
mov eax, dword [ebp - 0xc]
jmp 0x4080cb
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x4080ba
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x80070002
je 0x4080c8
cmp eax, 0x80070003
jne 0x4080cb
xor eax, eax
inc eax
pop esi
leave
ret 4

Function at 0x408508
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push dword [edi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x408540
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x408598
mov eax, dword [ebp - 4]
shr eax, 1
push 2
pop ecx
inc eax
mul ecx
setb cl
movsx ecx, cl
neg ecx
or ecx, eax
push ecx
call fcn.0042a9f1
cmp dword [ebp - 4], 0
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
je 0x408593
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x408598
movzx esi, si
or esi, 0x80070000
jmp 0x408598
xor eax, eax
mov word [ecx], ax
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x4085a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push dword [ebx + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x4085d8
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x40864c
mov edx, dword [ebp - 4]
test edx, edx
je 0x408644
shr edx, 1
add edx, 1
js 0x408654
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
mov eax, dword [edi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or ecx, eax
jge 0x408605
push edx
mov ecx, edi
call fcn.00401901
cmp dword [edi], 0
jne 0x408611
mov esi, 0x8007000e
jmp 0x408638
lea eax, [ebp - 4]
push eax
push dword [edi]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x408638
movzx esi, si
or esi, 0x80070000
push 0xffffffffffffffff
mov ecx, edi
call fcn.004040c6
pop edi
jmp 0x40864c
mov ecx, dword [ebp + 0xc]
call fcn.00401745
mov eax, esi
pop esi
pop ebx
leave
ret 8
push 0x80070057
call fcn.004012b5
int3

Function at 0x4089d4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push esi
push edi
push ebx
push eax
mov edi, ecx
call fcn.0040894b
cmp byte [ebp - 0x220], 0
je 0x408a0d
mov eax, dword [ebp - 0x224]
jmp 0x408a78
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x218]
and dword [ebp - 0x214], 0
or eax, 0xf003f
push 0
push eax
push ebx
push dword [edi + 4]
mov dword [ebp - 0x218], 0x435464
mov dword [ebp - 0x210], 0x200
call fcn.004081f8
mov esi, eax
cmp esi, 0x80070002
je 0x408a54
cmp esi, 0x80070003
jne 0x408a9d
xor esi, esi
inc esi
cmp dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0x435464
je 0x408a76
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415ff1
leave
ret 4
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.004089d4
mov esi, eax
test esi, esi
jne 0x408a57
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x21c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x408a89
cmp dword [ebp - 0x214], esi
je 0x408af8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 0x200
push ebx
mov ecx, edi
call fcn.00408082
mov esi, eax
jmp 0x408a57
Function at 0x409040
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4090a6
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x409098
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x14]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.00415ff1
leave
ret

Function at 0x40962a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp edi, 0x80000003
jne 0x409657
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00415ff1
leave
ret
push esi
push 0x802
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.00416d70
mov esi, dword [0x43dec4]
lea ecx, [ebp - 0x80c]
xor edx, edx
call fcn.00404b94
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push str.baselogging.cc
push 0
push esi
push dword [ebp - 0x80c]
push edi
push str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x80c]
add esp, 0x2c
lea ecx, [ecx - 0x10]
call fcn.004016ae
lea ecx, [ebp - 0x808]
call fcn.00409d0b
push 0x250012
push str.Exception
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
sub eax, 3
je 0x4096eb
sub eax, 1
jne 0x4096e3
int3
xor eax, eax
inc eax
jmp 0x40964a
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409d0b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409d7a
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x409d56
push ebx
push edi
push eax
call fcn.00416ed0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x409d71
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x40c287
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 9
mov esi, ecx
lea edi, [ebp - 0x50]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x4c]
dec ebx
not ebx
and ebx, dword [ebp + 8]
je 0x40c2dd
lea edi, [esi + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0040b6b5
mov esi, dword [ebp - 8]
cmp byte [esi + 0xd], 0
jne 0x40c2d8
cmp ebx, dword [esi + 0x10]
jb 0x40c2d8
cmp esi, dword [edi]
jne 0x40c2e6
sub ebx, dword [ebp - 0x4c]
jne 0x40c2b4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
add esi, 0x14
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp dword [ebp + 8], eax
sbb eax, eax
and eax, ebx
jmp 0x40c2df

Function at 0x40ebd2
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40ec6e
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40ec6e
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40ec6e
push 4
push 0xffffffffffffffff
push esi
push 0x40f338
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40ec6e
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 7
jbe 0x40ec39
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40ec6e
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x40ec74
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40ec70

Function at 0x40ed2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, ecx
push 0x2c
push 0
lea esi, [edi + 0xa0]
push esi
call fcn.00416d70
add esp, 0xc
lea eax, [edi + 0x8c]
push eax
lea eax, [ebp - 4]
push eax
push 0x2c
push esi
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ed80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40ed80
push 0xa
mov ecx, edi
call fcn.0040efa7
jmp 0x40ed8a
mov dword [edi + 0x84], 5
pop edi
pop esi
leave
ret
Function at 0x410c9f
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push esi
lea eax, [esp + 0xb]
mov byte [esp + 0xb], 0
push eax
push 0x410d58
mov esi, ecx
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [esp + 0xc]
call fcn.0040171e
push dword [ebp + 0xc]
lea eax, [esp + 0x10]
push dword [ebp + 8]
push str._s_s.dmp
push eax
call fcn.00408e30
lea ecx, [esp + 0x1c]
call fcn.004091f2
mov bl, byte [esp + 0x1b]
lea eax, [esp + 0x1c]
mov dl, byte [esi]
mov cl, bl
push 0
push eax
call fcn.004111f7
add esp, 0x18
cmp byte [esi + 1], 0
je 0x410d44
push dword [ebp + 0xc]
lea eax, [esp + 0x10]
push dword [ebp + 8]
push str._s_s_full.dmp
push eax
call fcn.00408e30
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.004091f2
mov ecx, dword [esp + 0xc]
call fcn.00403149
test al, al
je 0x410d44
mov dl, byte [esi]
lea eax, [esp + 0xc]
push 0
push eax
mov cl, bl
call fcn.004111f7
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004016ae
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x412925
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.00416d70
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x41298e
push ecx
mov edx, str..brave.com
lea ecx, [ebp - 0x204]
call fcn.00405153
pop ecx
test al, al
je 0x41298e
mov al, 1
jmp 0x4129d3
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], ebx
push eax
push 0x64
push ebx
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x4129c9
cmp dword [esi + 8], ebx
je 0x4129c9
push str.brave
push dword [esi + 8]
call fcn.004255e8
pop ecx
pop ecx
test eax, eax
jne 0x4129c9
mov bl, 1
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00415ff1
leave
ret

Function at 0x414db7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 8
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414dec
cmp dword [ebp - 8], 3
jne 0x414dec
cmp dword [ebp - 4], esi
jne 0x414dec
mov al, 1
jmp 0x414dfc
push esi
push 0
push dword [ebp + 8]
call fcn.00416d70
add esp, 0xc
xor al, al
pop esi
leave
ret
Function at 0x414dff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414e34
cmp dword [ebp - 8], 3
jne 0x414e34
cmp dword [ebp - 4], esi
jne 0x414e34
mov al, 1
jmp 0x414e44
push esi
push 0
push dword [ebp + 8]
call fcn.00416d70
add esp, 0xc
xor al, al
pop esi
leave
ret
Function at 0x415d72
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 0xc
lea edx, [ebx + 0x1c]
lea ecx, [ebx + 0x40]
mov esi, eax
lea eax, [ebx + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x3c]
push ecx
push eax
push edi
push esi
push ecx
lea ecx, [ebp - 0x88]
call fcn.00415bfd
lea ecx, [ebp - 0x30]
call fcn.0040e9b9
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x2c
mov eax, ecx
mov dword [ebp - 4], esi
push eax
push 0x2c
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x415e35
cmp dword [ebp - 0x30], 2
jne 0x415e35
cmp dword [ebp - 0x2c], esi
je 0x415e35
cmp dword [ebp - 0x10], esi
je 0x415e35
cmp dword [ebp - 0xc], esi
je 0x415e35
cmp dword [ebp - 8], esi
je 0x415e35
lea ecx, [ebp - 0x5c]
call fcn.0040e9b9
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x5c], 3
push eax
push 0x2c
mov eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415e35
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x34], eax
mov al, 1
jmp 0x415e37
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416b11
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416b50
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416b50
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416b50
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416b50
cmp dword [ecx + 0x74], 0xe
jbe 0x416b50
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41fd9e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41fde9
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041ffbb
test al, al
jne 0x41fde3
sub edx, 2
cmp edx, edi
jne 0x41fdc9
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41fe0b
lea eax, [edi + 2]
cmp edx, eax
je 0x41fe0b
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041fcea
add esp, 0x10
jmp 0x41ff05
push esi
lea ecx, [ebp - 0x255]
call fcn.0041ffbb
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41fe4e
push dword [ebp - 0x25c]
jmp 0x41fdfb
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41fe8b
cmp word [ebp - 0x226], 0
je 0x41feac
cmp word [ebp - 0x226], ax
jne 0x41fe8b
cmp word [ebp - 0x224], 0
je 0x41feac
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041fcea
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41fef8
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41fe65
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41fee0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41ff05
push 0x41fb1a
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00423ea0
add esp, 0x10
jmp 0x41fed5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415ff1
leave
ret

Function at 0x420d52
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42ef04
push 0x42eefc
push str.FlsAlloc
push 0x1f
call fcn.00420c8d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420d86
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d40c]
call esi
jmp 0x420d8c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x420dd0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42ef14
push 0x42ef0c
push str.FlsGetValue
push 0x21
call fcn.00420c8d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420e07
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d40c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]