joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b8aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdda3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1010739c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x10109060]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.100b8990
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x100b8c81
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.1008f970
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100eecc4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b8c81
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x100b8b75
cmp eax, 2
jne 0x100b8c81
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x100b8b96
test cl, 1
jne 0x100b8c81
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x100b8b9c
jmp 0x100b8c81
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x100b8c81
call fcn.1000b1c0
mov ecx, eax
test ecx, ecx
je 0x100b8cac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100b6d10
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100eeccc
push eax
call fcn.100b90a0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.100b72a0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x100b8c65
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100b8c06
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.100b8cc0
push dword [0x10109068]
lea eax, [ebp - 0x74]
push dword [0x10109064]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100b8c42
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100b8c5e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x100b8c83
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100b8c81
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x100b8c8e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100512b9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000afe0
int3
Function at 0x100b8da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cddd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1010739c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x10109060]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.100b8990
test eax, eax
je 0x100b8ec8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x10109060]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x100b8e73
cmp dword [esi], 0
je 0x100b8e66
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100b8e33
mov eax, 1
jmp 0x100b8e94
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100b8e6c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x100b8e94
cmp dword [esi + 4], 0
jne 0x100b8e73
mov eax, 1
jmp 0x100b8e94
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100b8ebe
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100b8ea6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x100b8ecb
xor ebx, ebx
jmp 0x100b8f6f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x100b8f6f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x100b8f28
mov ecx, dword [ebx]
test ecx, ecx
je 0x100b8f8e
push ecx
push eax
call fcn.1009caaa
add esp, 8
test eax, eax
je 0x100b8f28
mov edx, dword [edi]
test edx, edx
je 0x100b8f28
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8f00
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x100b8f33
lea eax, [edx + 0xd]
jmp 0x100b8f68
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8f40
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100eecc4
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x100b8f7a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000afe0
int3
Function at 0x100ba590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ba601
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x100ba5cf
cmp eax, 2
jne 0x100ba5eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x100ba5fb
test ecx, ecx
je 0x100ba5f6
test cl, 1
jne 0x100ba5eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x100ba5fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100bc110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ce09b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x1010739c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x14]
push 0x20000
push 0
push esi
call fcn.1008f970
add esp, 0xc
lea eax, [ebx + 0x20014]
push 0
push eax
push 0x20000
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100bc2da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x100bc297
cmp eax, 0xffffffff
je 0x100bc297
call fcn.1004f380
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100bc297
cmp dword [ebx + 0x2005c], 8
lea eax, [ebx + 0x20048]
mov dword [ebp - 0x14], eax
jb 0x100bc1c5
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.10009030
push 3
push 0x100d014c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10009030
mov byte [ebp - 4], 1
call fcn.1004f380
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x95
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100043b0
mov esi, eax
push str.RecvData_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.100064a0
add esp, 8
mov ecx, esi
push dword [ebp - 0x10]
call fcn.10017750
push str.__channel_name:
push esi
call fcn.100064a0
mov ecx, dword [ebp - 0x14]
mov eax, 0x100d00c4
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.10002f70
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10006970
lea ecx, [ebp - 0x2c]
call fcn.10005550
lea ecx, [ebp - 0x44]
call fcn.10005550
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0xc], 6
cmp esi, 0xe8
je 0x100bc2b8
cmp esi, 0xe9
je 0x100bc2b8
cmp esi, 0x6d
je 0x100bc2b8
cmp esi, 6
jne 0x100bc30e
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
mov dword [ecx + 4], eax
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x20014]
test eax, eax
je 0x100bc307
test esi, esi
je 0x100bc307
push dword [ebp - 0x10]
add eax, esi
push eax
push esi
push dword [ecx + 4]
call fcn.10064a30
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4622e7
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.004308b0
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.00463332
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.00463332
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x462375
cmp byte [ebp + 8], al
je 0x46236e
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.004224be
pop ecx
pop ecx
test eax, eax
je 0x462367
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x462421
xor al, al
jmp 0x462421
lea ecx, [esp + 0x10038]
call fcn.0046375b
test al, al
je 0x46236e
lea ecx, [esp + 0x38]
call fcn.0046375b
test al, al
je 0x462427
cmp byte [ebp + 8], 0
je 0x46236e
lea eax, [esp + 0x10038]
push 0x4b5538
push eax
call fcn.00421cfd
lea eax, [esp + 0x10040]
push eax
call fcn.00421b6c
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.00421b6c
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00407b51
lea ecx, [esp + 0x28]
call fcn.004626f1
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.00405832
inc bl
jne 0x46236e
lea ecx, [esp + 0x38]
call fcn.0046375b
test al, al
jmp 0x46239a
Function at 0x4627d9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.004073d7
lea ecx, [esp + 0x20]
call fcn.004073d7
lea ecx, [esp + 0x30]
call fcn.004073d7
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00404894
mov ecx, dword [esp + 0x10]
call fcn.0046375b
test al, al
je 0x462830
push 0x4b5538
lea ecx, [esp + 0x14]
call fcn.00407a1b
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.004046df
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x4628d0
cmp al, 1
jne 0x4628d0
test byte [esp + 0x40], 0x10
jne 0x4628ab
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.00407d2b
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.0040789e
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.00407a1b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x4628c7
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x462863
mov al, bl
mov byte [esp + 0xe], al
jmp 0x462863
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4628db
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x30]
call fcn.00405832
lea ecx, [esp + 0x20]
call fcn.00405832
lea ecx, [esp + 0x10]
call fcn.00405832
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468f67
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50000
call fcn.004308b0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20004]
push eax
push 0x7fff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4690c4
push ebx
lea eax, [ebp - 0x20004]
push eax
lea eax, [ebp - 0x10004]
push 0x4b5a60
push eax
call fcn.0042260a
lea eax, [ebp - 0x10004]
push eax
call fcn.00421b6c
mov ebx, eax
add esp, 0x10
cmp word [ebp + ebx*2 - 0x10006], 0x5c
jne 0x468fdf
cmp word [ebp + ebx*2 - 0x10008], 0x3a
je 0x468fdf
xor eax, eax
mov word [ebp + ebx*2 - 0x10006], ax
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x468ff9
cmp byte [ebp + 0x10], al
je 0x4690b5
push edi
push 0x2200000
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4690ac
push 0x2fffa
lea eax, [ebp - 0x50000]
push 0
push eax
call fcn.00421d50
lea eax, [ebx + ebx]
mov dword [ebp - 0x50000], 0xa0000003
mov word [ebp - 0x4fff6], ax
mov eax, dword [ebp - 0x4fff6]
add eax, 2
mov word [ebp - 0x4fff4], ax
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
lea eax, [ebp - 0x4fff0]
push eax
call fcn.0042302d
mov eax, dword [ebp - 0x4fff6]
lea ecx, [ebp + 8]
add esp, 0x18
xor edx, edx
add eax, 0xc
mov word [ebp - 0x4fffc], ax
movzx eax, ax
push edx
push ecx
push edx
push edx
add eax, 8
push eax
lea eax, [ebp - 0x50000]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
test eax, eax
jne 0x4690b9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
jmp 0x4690c2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push esi
push edi
mov ecx, 9
mov esi, str.SoftwarePortrait_DisplaysWinPortrait
lea edi, [esp + 0x18]
mov eax, 4
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
movsw word es:[edi], word [esi]
push eax
push 0xf003f
push 0
push ecx
push 0x80000001
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x4012ab
lea edx, [esp + 8]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.CTRL_HWND
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4012a0
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x38
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x38
ret
Function at 0x401590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35

Function at 0x4015a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35

Function at 0x4015d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004011e9
push eax
push esi
Function at 0x401910
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4018b0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4018ce
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40192c
mov edx, edi
mov dword [ebp + 8], edi
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x40190b
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401913
or byte [eax + ecx], 1
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 8], ebx
je 0x40191c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401926
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401908
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
test dword [eax - 1], edi
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x401892
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
add al, 7
sub eax, ecx
je 0x401979
dec eax
je 0x401970
sub eax, 3
je 0x401967
mov dword [ebp - 4], 0x40
jmp 0x401996
mov dword [ebp - 4], 4
jmp 0x40197c
mov dword [ebp - 4], 0x20
jmp 0x40197c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4019c8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401948
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004011d9
aad 0xf8
mov dl, 0xd7
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x4019d4

Function at 0x401ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid
Function at 0x401030
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x414170], esi
jne 0x40106c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x401062
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x41416c], eax
mov dword [0x414170], 1
mov eax, dword [0x41416c]
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401089
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4010c5
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x4010ba
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x4010ab
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x4010b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x4010cd
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x401600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x66c
mov eax, dword [0x414120]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push ebp
mov ebp, dword [esp + 0x678]
push esi
push edi
mov edi, dword [esp + 0x684]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x47a]
push ecx
mov word [esp + 0x47c], ax
call sub.MSVCR90.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
push 0x40e460
push ebp
mov dword [esp + 0x1c], 0x104
xor esi, esi
call ebx
lea edx, [esp + 0x10]
push edx
push 0x20019
push esi
push str.SoftwareAdobeAcrobat_Reader10.0Languagecurrent
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40176d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x474]
push ecx
push esi
push esi
push 0x40e3f4
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016b9
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esp + eax*2 + 0x46a]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40176d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x40176d
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x272]
push eax
mov word [esp + 0x274], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
lea ecx, [esp + 0x26c]
push ecx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Legal_
lea edx, [esp + 0x26c]
push edx
call edi
push esi
lea eax, [esp + 0x26c]
push eax
call edi
push 0x24c
lea ecx, [esp + 0x20]
push 0
push ecx
mov dword [esp + 0x24], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40176d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [esp + 0x18], 0x10
je 0x40176d
push esi
push ebp
call ebx
mov ecx, dword [esp + 0x678]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040cca0
add esp, 0x66c
ret
Function at 0x404520
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
push esi
push edi
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ebx, [ebp + ebp]
push ebx
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x2c]
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add esp, 0xc
add eax, 0x254
push eax
push ebp
push edi
push esi
push ecx
push str.labels
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc