joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8f0
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40f927
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [ebp - 4], al
mov eax, dword [ebp + 8]
neg eax
push 0
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x411477
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, 0x80004005
mov dx, cx
test edi, edi
jne 0x4114a5
lea eax, [esi - 2]
jmp 0x41155a
mov ebx, 0x402a3c
xor ecx, ecx
mov eax, dword [edi + ecx*4]
cmp eax, dword [ebx + ecx*4]
jne 0x4114c2
inc ecx
cmp ecx, 4
jne 0x4114ac
xor eax, eax
inc eax
jmp 0x41155a
movzx eax, dx
push eax
push 0x402568
push 0x40266c
lea eax, [ebp - 0x410]
push 0x104
push eax
call fcn.00406d75
add esp, 0x14
test eax, eax
js 0x411558
push ecx
lea eax, [ebp - 0x414]
mov ecx, 0x80000001
push eax
sub esp, 0x14
lea edx, [ebp - 0x410]
call fcn.00410f05
test eax, eax
jne 0x411558
push edi
lea ecx, [ebp - 0x208]
call fcn.00411570
test eax, eax
jne 0x41154c
lea ecx, [ebp - 0x208]
call fcn.004050d3
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push 0x402678
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
and esi, eax
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret
Function at 0x411721
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
test ebx, ebx
jne 0x41174c
mov eax, 0x80004003
jmp 0x41181b
push esi
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push ecx
lea eax, [ebp - 0x220]
mov edx, esi
push eax
sub esp, 0x14
mov ecx, edi
call fcn.00410f05
test eax, eax
je 0x41177b
mov eax, 0x80004005
jmp 0x41181b
mov eax, dword [ebx + 4]
xor ecx, ecx
mov edx, dword [ebx]
sub eax, edx
sar eax, 4
mov dword [ebp - 0x228], ecx
test eax, eax
je 0x41180d
mov esi, ecx
mov dword [ebp - 0x224], ecx
add esi, edx
lea edi, [ebp - 0x21c]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x20c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00411570
push ecx
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x22c]
push eax
sub esp, 0x14
lea edx, [ebp - 0x20c]
call fcn.00410f05
test eax, eax
jne 0x41180d
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebx]
inc ecx
mov esi, dword [ebp - 0x224]
sub eax, edx
add esi, 0x10
sar eax, 4
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], esi
cmp ecx, eax
jb 0x411799
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4

Function at 0x411833
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x41185b
mov eax, 0x80004003
jmp 0x411908
lea eax, [ebp - 0xc0]
push eax
push LockResource
push ecx
call fcn.00410e7c
test eax, eax
je 0x411879
xor eax, eax
inc eax
jmp 0x411908
xor esi, esi
push esi
push 0x4026e4
lea eax, [ebp - 0x28]
push 0x10
push eax
call fcn.00406d75
add esp, 0x10
test eax, eax
js 0x4118fa
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xc8], 0x80
push eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0xc4], 1
push eax
lea eax, [ebp - 0xc4]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4118f1
lea edx, [ebp - 0xac]
lea ecx, [ebp - 0xbc]
call fcn.0041159b
lea eax, [ebp - 0xbc]
mov ecx, edi
push eax
call fcn.00409b0b
inc esi
cmp esi, 0x100
jl 0x41187b
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4
Function at 0x41191f
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test esi, esi
jne 0x41194a
mov eax, 0x80070057
jmp 0x4119fd
push edi
mov ebx, 0x80000001
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push ecx
lea eax, [ebp - 0x250]
mov edx, edi
push eax
sub esp, 0x14
mov ecx, ebx
call fcn.00410f05
test eax, eax
je 0x411979
mov eax, 0x80004005
jmp 0x4119fd
mov eax, dword [esi + 4]
xor edi, edi
sub eax, dword [esi]
sar eax, 4
test eax, eax
je 0x4119ef
xor ebx, ebx
push edi
push 0x4026e4
lea eax, [ebp - 0x4c]
push 0x20
push eax
call fcn.00406d75
add esp, 0x10
test eax, eax
js 0x4119ef
mov eax, dword [esi]
lea ecx, [ebp - 0x24c]
add eax, ebx
push eax
call fcn.00411570
lea ecx, [ebp - 0x24c]
call fcn.004050d3
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x24c]
push eax
push 1
push 0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esi + 4]
inc edi
sub eax, dword [esi]
add ebx, 0x10
sar eax, 4
cmp edi, eax
jb 0x411989
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4

Function at 0x412555
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41bdfc]
push ebx
mov ebx, edx
test eax, eax
jne 0x41256e
xor eax, eax
jmp 0x4125fa
mov edx, dword [eax]
movzx eax, word [eax + 4]
mov dword [ebp - 4], edx
test edx, edx
je 0x412567
test ebx, ebx
je 0x412567
push esi
push edi
mov edi, ecx
xor esi, esi
push eax
shr ecx, 4
and edi, 0xf
inc ecx
movzx eax, cx
push eax
push 6
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4125f6
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4125f6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x4125f6
test edi, edi
je 0x4125cb
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edi, 1
jne 0x4125bd
mov edi, dword [ebp + 8]
movzx esi, word [ecx]
dec edi
mov eax, esi
cmp esi, edi
jl 0x4125da
mov eax, edi
add eax, eax
push eax
lea eax, [ecx + 2]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp esi, edi
jge 0x4125f0
mov edi, esi
xor eax, eax
mov word [ebx + edi*2], ax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412d18
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
xor esi, esi
mov eax, dword [0x41bdfc]
test eax, eax
je 0x412d4f
movzx ebx, word [eax + 4]
jmp 0x412d51
mov ebx, esi
call fcn.0041267c
mov edx, 0xffff
test eax, eax
jne 0x412d80
mov ecx, ebx
call fcn.0041267c
test eax, eax
je 0x412d6f
movzx ecx, bx
jmp 0x412d80
mov ecx, dword [ebp + 8]
call fcn.0041267c
movzx ecx, cx
test eax, eax
jne 0x412d80
mov ecx, edx
cmp cx, dx
jne 0x412df2
mov dword [ebp - 8], esi
mov edi, esi
movzx ecx, word [edi + 0x4027d0]
call fcn.00412171
test eax, eax
je 0x412d9e
mov eax, dword [eax]
jmp 0x412da0
mov eax, esi
test eax, eax
je 0x412de5
push 0x4027a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412de5
push ebx
push dword [ebp - 0x10]
mov ecx, eax
push dword [ebp - 0xc]
call dword [0x41f3ec]
call dword [ebp - 0x14]
mov dword [ebp - 8], eax
test eax, eax
jne 0x412de8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 8]
add edi, 2
cmp edi, 8
jb 0x412d8a
jmp 0x412dd2
call fcn.00412171
test eax, eax
je 0x412dfd
mov esi, dword [eax]
test esi, esi
je 0x412dd0
push 0x4027a0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x412dd0
push ebx
push edi
push dword [ebp - 0xc]
mov ecx, esi
call dword [0x41f3ec]
call esi
jmp 0x412dd2

Function at 0x41300b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41bdfc]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], ecx
test eax, eax
je 0x413082
mov ebx, dword [eax]
movzx eax, word [eax + 4]
push eax
movzx ecx, cx
push ecx
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x413058
mov ecx, dword [ebp - 4]
push eax
movzx eax, cx
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x413082
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413082
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x413082
push esi
push 0x4130a0
push dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
jmp 0x413085
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41325d
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push edi
push eax
mov ebx, ecx
push esi
mov dword [ebp - 0x30], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.00413915
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
push 0x46
push eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
test esi, esi
je 0x413315
push 5
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x413315
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x18]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], ebx
add eax, ebx
push 0x45
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x4132cb
mov ebx, dword [ebp - 0x30]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jle 0x413367
lea ecx, [edi*2 + 8]
push ecx
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebx + 4], eax
pop ecx
test eax, eax
je 0x413353
lea ecx, [edi + 1]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x402418
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
call fcn.0041245f
xor ecx, ecx
push 0
inc ecx
push eax
mov edx, ecx
call fcn.00412bb3
mov dword [ebx], eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 8]
and eax, 0x400
or eax, 0x800
xor ecx, ebp
shr eax, 9
pop edi
mov dword [ebx + 0xc], eax
xor eax, eax
pop esi
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41353f
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
shr eax, 0x10
push edi
cwde
push eax
movsx eax, dx
push eax
push esi
mov dword [ebp - 0x3c], ebx
call fcn.00413897
lea edx, [ebp - 0x38]
mov ecx, esi
mov edi, eax
call fcn.00413915
lea ecx, [ebx + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SetRectEmpty]
cmp edi, 2
ja 0x413615
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor ebx, ebx
lea eax, [ebp - 0x38]
inc ebx
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x3c]
mov dword [eax + 0x3c], edi
add eax, 0x14
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x3c]
add eax, 0x1c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
call dword [sym.imp.USER32.dll_SetCapture]
xor ecx, ecx
sub edi, ecx
je 0x4135ff
sub edi, ebx
je 0x4135fa
sub edi, ebx
jne 0x41369b
lea eax, [ebp - 0x18]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41369b
lea eax, [ebp - 0x28]
jmp 0x4135ec
mov eax, dword [ebp - 0x3c]
push ecx
add eax, 0x40
push eax
push ecx
push 0x26
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x41369b
mov edi, dword [ebp - 0x3c]
xor ebx, ebx
inc ebx
cmp dword [edi + 0x3c], ebx
jne 0x413694
mov dword [edi + 0x3c], 3
call dword [sym.imp.USER32.dll_ReleaseCapture]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp - 0x40]
mov ecx, esi
push dword [ebp - 0x44]
call fcn.00410c36
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x413694
cmp eax, esi
je 0x413694
push eax
mov dword [ebp - 0x60], 0x1c
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [ebp - 0x3c]
and dword [ebp - 0x50], 0
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x53
push ecx
mov dword [ebp - 0x54], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x3c], 3
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41648f
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x41be44]
test eax, eax
jne 0x416561
push 0x402820
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x41be44], eax
test eax, eax
jne 0x4164b1
ret
push 0x402834
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402844
push dword [0x41be44]
mov dword [0x41be40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402854
push dword [0x41be44]
mov dword [0x41be3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402868
push dword [0x41be44]
mov dword [0x41be38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40287c
push dword [0x41be44]
mov dword [0x41be34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40288c
push dword [0x41be44]
mov dword [0x41be30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40289c
push dword [0x41be44]
mov dword [0x41be2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4028ac
push dword [0x41be44]
mov dword [0x41be28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41be24], eax
mov eax, dword [0x41be44]
ret

Function at 0x416731
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x138
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x134], eax
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne al
mov byte [esp + 0x134], al
test al, al
je 0x4167e4
cmp dword [esp + 0x1c], 6
jb 0x4167e4
lea eax, [esp + 0xc]
xor edi, edi
push eax
push LockResource
push edi
push 0x4028f8
xor esi, esi
mov dword [esp + 0x1c], edi
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4167e0
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
push edi
push edi
push 0x40296c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4167d6
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
and esi, eax
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4167e6
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
xor ecx, esp
call fcn.00418a00
mov esp, ebp
pop ebp
ret
Function at 0x41693c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x88]
push edi
push 0x40
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x416973
or eax, 0xffffffff
jmp 0x416ace
lea eax, [ebp - 0x88]
push eax
push 0x402980
lea eax, [ebp - 0x288]
push 0x100
push eax
call fcn.00406d75
add esp, 0x10
test eax, eax
js 0x41696b
lea eax, [ebp - 0x28c]
push eax
push LockResource
push ecx
lea edx, [ebp - 0x288]
mov ecx, 0x80000000
call fcn.00410e7c
test eax, eax
jne 0x416ace
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], 0x208
push eax
push esi
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x416ac0
push 2
pop edx
mov ebx, 0x104
cmp dword [ebp - 0x290], edx
jne 0x416a66
xor ecx, ecx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004192f1
pop ecx
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x416a44
cmp eax, ebx
jae 0x416a44
mov ecx, edi
call fcn.004050d3
cmp eax, ebx
jb 0x416a51
push 0xffffffffffffffff
push edi
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
cmp eax, 0x50
jne 0x416a5e
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
or edi, 0xffffffff
jmp 0x416ac0
push eax
push edi
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x416a84
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcsnlen]
pop ecx
pop ecx
cmp eax, ebx
je 0x416a84
lea ecx, [ebp - 0x298]
test ecx, ecx
je 0x416abe
jmp 0x416a90
lea eax, [ebp - 0x298]
test eax, eax
je 0x416abe
xor eax, eax
test eax, eax
je 0x416abe
push 0x22
pop ecx
cmp word [esi], cx
jne 0x416abe
cmp word [esi + eax*2 - 2], cx
jne 0x416abe
lea ecx, [eax - 2]
lea eax, [esi + 2]
cmp ecx, ebx
jb 0x416ab1
push 0xffffffffffffffff
jmp 0x416ab2
push ecx
push eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
xor edi, edi
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 8
Function at 0x4189f0
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x41a420
call fcn.004191f4
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
xor esi, esi
mov edx, 0x41dff4
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4187f5
cmp eax, edi
jne 0x418807
mov esi, ebx
cmp dword [0x41dff8], ebx
jne 0x418814
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x418843
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4187de
cmp dword [0x41dff8], 0
jne 0x41883d
mov dword [0x41dff8], ebx
push 0x40102c
push 0x401020
call fcn.00418994
pop ecx
pop ecx
test eax, eax
je 0x418843
jmp 0x41897d
mov dword [0x41b548], ebx
cmp dword [0x41dff8], ebx
jne 0x418866
push 0x40101c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41dff8], 2
test esi, esi
jne 0x418873
xor eax, eax
mov ecx, 0x41dff4
xchg dword [ecx], eax
cmp dword [0x41e004], 0
je 0x4188a1
push 0x41e004
call fcn.00419020
pop ecx
test eax, eax
je 0x4188a1
push 0
push 2
push 0
mov esi, dword [0x41e004]
mov ecx, esi
call dword [0x41f3ec]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x41897d
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x24]
movzx eax, word [ecx]
cmp ax, si
ja 0x418911
test ax, ax
je 0x4188ca
test edx, edx
jne 0x418911
movzx eax, word [ecx]
test ax, ax
je 0x4188df
cmp ax, si
ja 0x4188df
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x4188ca
test byte [ebp - 0x40], 1
je 0x4188eb
movzx eax, word [ebp - 0x3c]
jmp 0x4188ee
push 0xa
pop eax
push eax
push ecx
push 0
push 0x400000
call main
mov dword [0x41b544], eax
cmp dword [0x41b55c], 0
jne 0x418959
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x418922
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x24], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x4188b9
cmp dword [0x41b548], 0
jne 0x41896d
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x41b544]
mov dword [ebp - 4], 0xfffffffe
jmp 0x418989
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0041923c
ret
call fcn.00419128
jmp 0x4187a8

Function at 0x418f0f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41a468
call fcn.00419288
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x418f6f
cmp eax, 0xffffffff
je 0x418f6f
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x418f68
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x418f68
cmp edx, 0x10000000
jae 0x418f68
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x418f65
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004192cd
ret 4
Function at 0x418fd0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41900e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x419006
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x419010
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x418ff6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4190f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x419106
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x419121
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x100010d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100010fb
push 0
push 0
push 0
push 0x10001020
push 0
push 0
call fcn.1001240f
add esp, 0x18
test eax, eax
je 0x100010fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc