joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432151
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x432194
call fcn.0043af3d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x432194
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4321af
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00431d0b
test ebx, ebx
mov esi, eax
je 0x4321ad
test edi, edi
je 0x4321ad
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x434b23
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc

Function at 0x434b3b
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_send]
ret 0xc

Function at 0x434be0
Capabilities:
Connect socket

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8
Function at 0x4367fc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jne 0x43682f
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x20]
cmp eax, dword [ebp - 4]
je 0x43685a
test byte [ebp - 4], 1
je 0x43685a
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43685a
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
lea eax, [esi + 8]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x43690a
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00436761
pop ecx
lea eax, [esi + 0x10]
pop ecx
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x436890
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00436761
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x4368a9
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00436761
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4368d4
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4368f4
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x43690a
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
movzx eax, byte [esi + 0x20]
cmp eax, dword [ebp - 4]
je 0x436932
test byte [ebp - 4], 1
jne 0x436932
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x436932
push dword [ebp + 8]
call edi
push eax
call fcn.00440c6a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43d1ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x43d210
call fcn.0043af3d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43d210
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x43d253
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x43d23c
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x43d23c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x43d250
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43df9a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43dfc8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43dfe6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043df04
jmp 0x43dfe6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43dfe6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043df04
test edi, edi
mov eax, edi
jne 0x43dfd0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4882bc]
test ecx, ecx
je 0x43e0a9
jmp 0x43df99
ret 8

Function at 0x44d5bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4851d0]
jne 0x44d5c5
repz ret
jmp fcn.00455e9c
Function at 0x45f615
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00453da2
xor ebx, ebx
cmp dword [0x489130], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x45f6ea
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x45f655
xor eax, eax
jmp 0x45f7ae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x45f64e
push eax
call fcn.00453d3f
mov dword [esp], 0x475048
push edi
mov dword [0x489130], eax
call esi
push eax
call fcn.00453d3f
mov dword [esp], 0x475034
push edi
mov dword [0x489134], eax
call esi
push eax
call fcn.00453d3f
mov dword [0x489138], eax
lea eax, [ebp - 8]
push eax
call fcn.004528fd
test eax, eax
pop ecx
pop ecx
je 0x45f6b8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044cf06
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x45f6ea
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00453d3f
cmp eax, ebx
pop ecx
mov dword [0x489140], eax
je 0x45f6ea
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00453d3f
pop ecx
mov dword [0x48913c], eax
mov eax, dword [0x48913c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x45f763
cmp dword [0x489140], esi
je 0x45f763
push eax
call fcn.00453dab
pop ecx
call eax
cmp eax, ebx
je 0x45f730
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x489140]
call fcn.00453dab
pop ecx
call eax
test eax, eax
je 0x45f730
test byte [ebp - 0x18], 1
jne 0x45f763
lea eax, [ebp - 0xc]
push eax
call fcn.00452934
test eax, eax
pop ecx
je 0x45f74b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044cf06
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x45f75a
or dword [ebp + 0x10], 0x200000
jmp 0x45f794
or dword [ebp + 0x10], 0x40000
jmp 0x45f794
mov eax, dword [0x489134]
cmp eax, esi
je 0x45f794
push eax
call fcn.00453dab
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45f794
mov eax, dword [0x489138]
cmp eax, esi
je 0x45f794
push dword [ebp - 4]
push eax
call fcn.00453dab
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x489130]
call fcn.00453dab
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4658f2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4851d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00465887
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0044d9b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x465941
cmp dword [ebp - 0x1c], 5
jb 0x465959
jmp 0x465955
cmp dword [ebp - 0x10], 1
jne 0x465959
cmp dword [ebp - 0x1c], 4
ja 0x465955
jne 0x465959
cmp dword [ebp - 0x18], 0
jbe 0x465959
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x476948
call fcn.0046575b
test eax, eax
jge 0x46597a
mov byte [0x486588], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044d5bb
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
lea esi, [ebp - 0xc]
push 0x400000
push esi
call fcn.00402bb0
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4010b0
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
je 0x4010cf
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
mov dword [esi + 4], 0x404120
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov word [esi + 0x10], 0
mov byte [esi + 0x12], 1
mov dword [esi + 0x14], eax
push 0xa
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40113c
mov ecx, edi
mov edi, eax
push eax
push ecx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40113c
mov ecx, ebx
mov ebx, eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x40113c
mov edi, eax
and eax, 1
jne 0x40113c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40113c
and edi, 0xfffffffe
cmp word [edi + eax - 2], 0
jne 0x40113c
mov dword [esi + 0x14], eax
lea edi, [ebp - 0x10]
mov dword [edi], 0
push 2
push edi
push 0x404640
push str.SoftwareGoogle
push 0x80000001
call fcn.00403370
add esp, 0x14
cmp word [edi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [esi + 0x12], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, esi
push eax
call fcn.00401190
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x401190
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edi, [ecx + 0xc]
push edi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esi], eax
test eax, eax
je 0x4011ff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edi
cmp dword [edi], 2
jl 0x4011ca
xor edi, edi
inc edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x401235
cmp byte [esi + 0x10], 0
mov ebx, dword [ebp - 0x10]
jne 0x4011ff
xor eax, eax
lea edi, [ebp - 0x1a]
mov word [edi + 4], ax
mov word [edi], ax
push 2
push edi
push str.GoogleUpdateIsMachine
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [edi], 0x31
sete cl
and cl, al
mov byte [esi + 0x10], cl
test ebx, ebx
setne al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [esi + 4], str.401C381F_E0DE_4B85_8BD8_3F3F14FBDA57
jmp 0x40122d
mov dword [esi + 4], str.4ea16ac7_fd5a_47c3_875b_dbf4a2008c20
jmp 0x40122d
mov dword [esi + 4], str.8237E44A_0054_442C_B6B6_EA0509993955
jmp 0x40122d
mov byte [esi + 0x10], 1
inc edi
mov eax, dword [ebp - 0x14]
cmp edi, dword [eax]
jge 0x4011ca
mov eax, dword [esi]
push str.__system_level
push dword [eax + edi*4]
call ebx
test eax, eax
je 0x401229
mov eax, dword [esi]
push str.__chrome_beta
push dword [eax + edi*4]
call ebx
test eax, eax
je 0x401220
mov eax, dword [esi]
push str.__chrome_dev
push dword [eax + edi*4]
call ebx
test eax, eax
je 0x40120e
mov eax, dword [esi]
push str.__chrome_sxs
push dword [eax + edi*4]
call ebx
test eax, eax
je 0x401217
mov eax, dword [esi]
push str.__cleanup
push dword [eax + edi*4]
call ebx
test eax, eax
je 0x401295
mov eax, dword [esi]
push str.__chrome_frame
push dword [eax + edi*4]
call ebx
test eax, eax
jne 0x40122d
mov byte [esi + 0x11], 1
jmp 0x40122d
Function at 0x401ee0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
lea ecx, [ebp - 0x64]
movups xmmword [ecx + 0x34], xmm0
movups xmmword [ecx + 0x24], xmm0
movups xmmword [ecx + 0x14], xmm0
movups xmmword [ecx + 4], xmm0
mov dword [ecx], 0x44
lea edx, [ebp - 0x20]
movups xmmword [edx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x404470]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401f7f
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401fae
mov edi, 0x6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp edi, 3
je 0x401f9d
cmp edi, 2
jne 0x401fa4
mov ecx, dword [ebp + 0x14]
jmp 0x401fa0
mov ecx, dword [ebp + 0x18]
mov dword [esi], ecx
jmp 0x401f72
mov eax, dword [ebp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x401f75
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401f65
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [ebp - 0x10]
jmp 0x401f70
Function at 0x402930
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x260
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], ebx
lea edi, [ebp - 0x26a]
mov word [edi + 0x208], bx
mov word [edi], bx
mov dword [ebp - 0x10], ebx
push 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x402a0e
sub esp, 0x20
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
lea esi, [ebp - 0x10]
mov dword [esp + 0x14], esi
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x402a0e
test byte [ebp - 0x10], 8
mov bl, 1
je 0x402a10
mov dword [ebp - 0x10], 0
push esi
call fcn.00402890
add esp, 4
xor ebx, ebx
test al, al
je 0x402a10
mov word [ebp - 0x12], bx
mov word [ebp - 0x26a], bx
push 0x4044a0
push 0x12c
push edi
call fcn.00403010
add esp, 0xc
test al, al
je 0x402a03
push dword [ebp - 0x10]
push 0x12c
push edi
call fcn.00403010
add esp, 0xc
test al, al
je 0x402a01
push 0x40455a
push 0x12c
push edi
call fcn.00403010
add esp, 0xc
test al, al
jne 0x402a1d
xor ebx, ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x402a10
mov bl, 1
mov eax, ebx
add esp, 0x260
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push dword [ebp + 0xc]
push 1
push edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne bl
jmp 0x402a03
Function at 0x402a40
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0x6c
push esi
push 0x104
push ebx
call fcn.00402fd0
add esp, 0xc
test al, al
je 0x402a89
push 0x40461a
push 0x104
push ebx
call fcn.00403010
add esp, 0xc
test al, al
jne 0x402a93
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0x104
push edi
push ebx
call fcn.00402fa0
add esp, 8
mov ecx, eax
sub edi, eax
xor eax, eax
cmp edi, 0xb
jb 0x402a8b
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx - 4], 0xc
push ecx
push esi
call fcn.00402930
add esp, 8
test al, al
jne 0x402b1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], 0x75
jmp 0x402a89
push 0x404568
push 0x104
push ebx
call fcn.00403010
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x402b0c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
sete al
jmp 0x402a8b
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0x6d
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + eax*2]
mov dword [ebp - 0x1c], ecx
add eax, 5
mov dword [ebp - 0x18], eax
mov esi, 0xfffffff6
jmp 0x402b7e
mov eax, dword [ebp - 0x10]
mov word [ebx + eax*2 + 0xa], 0
push str..tmp
push 0x104
push ebx
call fcn.00403010
add esp, 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
lea ecx, [ebp - 0x28]
cmovne eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402ae1
inc esi
je 0x402afe
mov eax, 4
push eax
lea edi, [ebp - 0x2c]
push edi
call sub.ADVAPI32.dll_SystemFunction036
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov eax, 4
push eax
push edi
call fcn.00402f30
add esp, 0x10
cmp dword [ebp - 0x18], 0x103
ja 0x402b4d
jmp 0x402b43

Function at 0x403230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x10]
xor eax, eax
add edx, edx
lea ebx, [ebp - 0x10]
mov dword [ebx], edx
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push esi
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40326b
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, 0x32
cmp dword [ebp - 0x14], 1
jne 0x403261
mov ecx, dword [ebp - 0x10]
cmp ecx, 2
jb 0x40329a
mov eax, ecx
and eax, 0xfffffffe
cmp word [eax + esi - 2], 0
je 0x40329f
shr ecx, 1
mov eax, 0xea
cmp ecx, dword [ebp + 0x10]
jae 0x403261
lea esi, [esi + ecx*2]
mov word [esi], 0
xor eax, eax
jmp 0x403261
Function at 0x4032b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
lea esi, [ebp - 0x14]
mov dword [esi], edx
lea edi, [ebp - 0x10]
mov dword [edi], 4
mov ebx, dword [ebp + 0xc]
push edi
push ebx
push esi
push edx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4032ea
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, 0x32
cmp dword [ebp - 0x14], 4
jne 0x4032e0
xor ecx, ecx
cmp dword [ebp - 0x10], 4
mov eax, 0xe8
cmove eax, ecx
jmp 0x4032e0

Function at 0x403370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
lea edx, [ebp - 0x10]
mov dword [edx], ebx
push edx
push 1
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4033ae
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4033a4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + edi]
lea edx, [ebp - 0x14]
mov dword [edx], ecx
lea ecx, [ebp - 0x18]
mov dword [ecx], ebx
push edx
push esi
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403396
cmp dword [ebp - 0x18], 1
jne 0x403396
mov eax, dword [ebp - 0x14]
cmp eax, 2
jb 0x4033fa
mov ecx, eax
and ecx, 0xfffffffe
cmp word [ecx + esi - 2], 0
je 0x4033ff
shr eax, 1
cmp eax, edi
jae 0x403403
lea esi, [esi + eax*2]
mov word [esi], 0
mov bl, 1
jmp 0x403396
xor ebx, ebx
jmp 0x403396

Function at 0x4034a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x220]
mov ecx, esi
call fcn.00401b10
mov ecx, esi
push edi
call fcn.00401b60
test al, al
je 0x40353b
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x403514
xor esi, esi
sub ebx, esi
mov ecx, 0x800000
cmp ebx, ecx
cmovae ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, dword [eax]
add edi, esi
lea ecx, [ebp - 0x220]
call fcn.00401c90
xor ecx, ecx
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403518
add esi, ebx
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
cmp esi, ebx
jb 0x4034d4
mov bl, 1
jmp 0x40353d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00401c00
mov ecx, edi
call fcn.00401b30
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [ebp - 0x220]
call fcn.00401b30
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4167d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x416820
cmp esi, edi
ja 0x416888
cmp edi, dword [esp + 0x1c]
ja 0x41689b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x416822
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x416810
jmp 0x41687f
ja 0x416828
cmp eax, edx
mov esi, edi
jne 0x4167e3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x416860
mov ebp, esi
sub ecx, edx
jns 0x416877
jmp 0x416881
cmp esi, edi
je 0x4168b0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x416881
xor al, 1
cmp ebp, edi
jne 0x416840
jmp 0x416881
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0xc3d710
call fcn.0044a3b0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0xc3d710
call fcn.0044a1a0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_2c1b65ee1431f8d3fe2142e821eb13c623bbf8a0librarycore_srcio_borrowed_buf.rs_rustc_2c1b65ee1431f8d3fe2142e821eb13c623bbf8a0library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0xc3d700
call fcn.0044a210
add esp, 4
ud2