joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107a99d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x1084428]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x118]
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x108], 1
sete al
xor edi, edi
cmp dword [esi + 4], 2
mov dword [esi + 0x20], eax
jne 0x107aa69
cmp eax, edi
je 0x107aa69
lea eax, [ebp - 0x120]
push eax
push 0x1009f9c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x107aa69
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
push edi
push 0x1009f70
push dword [ebp - 0x120]
mov dword [ebp - 0x124], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x107aa69
cmp dword [ebp - 0x11c], edi
je 0x107aa69
push 0x1009f54
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x107aa5d
push 0x1009f40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.0107ac8a
fstp st(0)
cmp dword [esi + 0x34], edi
jne 0x107aa97
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
cmp eax, edi
mov ecx, esi
jge 0x107aa8e
push 1
push eax
call fcn.0107804a
jmp 0x107ab0d
call fcn.0107a655
cmp eax, edi
jl 0x107ab0d
cmp dword [esi + 4], 2
jne 0x107aaaf
push edi
lea eax, [ebp - 0x11c]
push eax
push 1
push 0x61
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x13c], edi
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x107aae7
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x107ab02
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x34], edi
mov ecx, esi
je 0x107aafd
call fcn.01077909
jmp 0x107ab02
call fcn.010777d4
cmp dword [ebp - 0x13c], 0x12
jne 0x107aab5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010123a2
leave
ret
Function at 0x107e3ad
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x10aee2c]
mov eax, dword [0x1084428]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x107e593
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x10aee40]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x107e593
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x107e41e
xor eax, eax
jmp 0x107e5a7
test al, 0x20
je 0x107e431
push 2
push 0
push 0
push ecx
call fcn.0107ee88
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x107e4f1
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x107e56d
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x107e4a0
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x107e48e
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x107e46a
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x107e51f
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x107e52b
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x107e456
jmp 0x107e52b
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x107e51f
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x107e52b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x107e58b
cmp dword [ebp - 0x40c], eax
je 0x107e567
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x107e559
mov dword [0x10ad31c], 9
mov dword [0x10ad320], eax
jmp 0x107e5a4
push dword [ebp - 0x40c]
call fcn.0107ed52
pop ecx
jmp 0x107e5a4
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x107e57f
cmp byte [edi], 0x1a
je 0x107e417
mov dword [0x10ad31c], 0x1c
jmp 0x107e59d
sub eax, dword [ebp - 0x420]
jmp 0x107e5a7
mov dword [0x10ad31c], 9
and dword [0x10ad320], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010123a2
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x317b44a2
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6e9c7211
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402b80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x414468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea ecx, [esp]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 1
call fcn.00413970
push 0x2e
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 1
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x402bd6
lea eax, [esp + 0x1c]
lea ecx, [esp]
push eax
call sub.MFC42u.DLL_CString::operator
jmp 0x402c0d
push 0x2e
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::ReverseFind
lea ecx, [esp + 4]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x18], 2
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call sub.MFC42u.DLL_CString::CString
push ebp
lea edx, [esp + 8]
push esi
xor ebp, ebp
push edx
push 0xf003f
push ebp
push str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
push 0x80000002
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402c38
mov ebp, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 8]
push edi
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
je 0x402c65
xor esi, esi
jmp 0x402c69
mov esi, dword [esp + 0x10]
test ebp, ebp
je 0x402c74
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x402cb0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x414498
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0
mov ebx, 1
call fcn.00413970
push 0x2e
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x402d04
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
call sub.MFC42u.DLL_CString::operator
jmp 0x402d3a
push 0x2e
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::ReverseFind
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0xc]
xor esi, esi
push edx
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetControlSession_ManagerKnownDLLs
push 0x80000002
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d63
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x402d75
xor ebx, ebx
test esi, esi
je 0x402d80
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x403f50
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4146d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x24], 0
mov ebp, 1
mov dword [esp + 0x10], esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_Compatibility_
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_operator_1
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ecx
push 0x80000002
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403fca
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], esi
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push str.Compatibility_Flags
push esi
mov dword [esp + 0x24], 0x400
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x403fef
xor ebp, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404002
push esi
call ebx
xor esi, esi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x404012
push esi
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x404040
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x4146fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x234], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_Compatibility
push 0x80000002
mov dword [esp + 0x24], edi
call esi
cmp eax, edi
jne 0x4040a2
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x23c]
push ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x238], 2
push ecx
push 0x2001f
push edi
push eax
push ebx
mov dword [esp + 0x30], edi
call esi
mov esi, eax
cmp esi, edi
jne 0x4040ea
lea ecx, [esp + 0x10]
call fcn.00404200
mov esi, eax
mov eax, dword [esp + 0x1c]
cmp esi, edi
mov dword [esp + 0x10], eax
je 0x404100
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 1
call fcn.00404200
jmp 0x404196
lea edx, [esp + 0x28]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edx
push edi
push edi
lea ecx, [esp + 0x20]
push edi
lea edx, [esp + 0x40]
push ecx
push edx
push edi
push eax
mov dword [esp + 0x34], 0x100
call ebp
test eax, eax
jne 0x404162
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
call fcn.00404220
mov esi, eax
cmp esi, edi
jne 0x4040ea
lea ecx, [esp + 0x28]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push edi
push edi
lea eax, [esp + 0x40]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x34], 0x100
call ebp
test eax, eax
je 0x404128
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x404175
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x20]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x404196
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
cmp esi, edi
pop ebp
je 0x40419f
mov dword [esp + 0x14], edi
cmp ebx, edi
je 0x4041aa
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x23c]
mov dword [esp + 0x234], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x22c
ret 4
Function at 0x404220
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x41471b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x234]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x404298
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x404288
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x4042aa
jmp 0x40429c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x404345
push ecx
jmp 0x40433f
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x404310
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.00404220
mov ebx, eax
cmp ebx, edi
jne 0x404361
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x4042d2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x404323
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x234]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x404345
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x404370
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x404347
Function at 0x406050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x414b88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.00413970
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.00413970
lea eax, [esp + 0x44]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x40], 2
call sub.MFC42u.DLL_CString::operator
push 0x41b354
push 0x41b02c
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Replace
lea ecx, [esp + 8]
push str..reg_
push ecx
push str.Regs_
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x41b778
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x38]
mov ecx, esi
push edx
call fcn.0040e300
mov edi, eax
lea eax, [esp + 0x50]
lea ecx, [esp + 0x30]
push eax
push str._export__
push ecx
mov byte [esp + 0x54], 3
call sub.MFC42u.DLL_operator_1
push 0x41b9bc
lea edx, [esp + 0x30]
push eax
push edx
mov byte [esp + 0x54], 4
call sub.MFC42u.DLL_operator
push edi
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x50], 5
push eax
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x50], 6
call sub.MFC42u.DLL_operator
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x4c], 7
call sub.MFC42u.DLL_operator_2
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x48], 8
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 9
call sub.MFC42u.DLL_CString::operator
mov byte [esp + 0x3c], 8
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 7
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 2
call sub.MFC42u.DLL_CString::CString
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00413b2c
push ecx
mov byte [esp + 0x44], 0xa
mov edi, esp
mov dword [esp + 0x38], esp
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str._SystemRoot__system32_reg.exe
call sub.MFC42u.DLL_CString::CString_1
push edi
mov ecx, esi
call fcn.0040e0f0
mov ecx, esi
mov byte [esp + 0x44], 2
call fcn.0040e660
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret 4
Function at 0x40d4d0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4fb
mov esi, dword [esp + 4]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.AllowProtectedRenames
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x40d525
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x40dc60
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415410
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edx, dword [esp + 0x24]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x1c]
push 0
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x40df70
Capabilities:
Access peb ldr_data
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x415478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0
call fcn.00413970
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.00413970
lea eax, [esp + 0x28]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x24], 2
call sub.MFC42u.DLL_CString::operator
push 0x41b354
push 0x41f780
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Replace
push 0x41b354
push 0x41b02c
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Replace
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc]
push ecx
push 0x41b030
push edx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 3
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 4]
push eax
push str.Files_
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41b778
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x30], 4
call sub.MFC42u.DLL_operator
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2c], 5
call sub.MFC42u.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 6
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x28]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x40e0f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4154af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push 0
push 0
push eax
mov dword [esp + 0x24], 1
call ebp
mov edi, eax
lea ecx, [edi + edi]
push ecx
call sub.MFC42u.DLL_operatornew
mov edx, dword [esp + 0x28]
add esp, 4
mov esi, eax
push edi
push esi
push edx
call ebp
push esi
lea eax, [esp + 0x28]
push 0x41b170
push eax
call sub.MFC42u.DLL_CString::Format
push esi
call sub.MFC42u.DLL_operatordelete
mov esi, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00413b2c
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40e1a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [esp + 0x14]
pop edi
sub eax, 2
jne 0x40e23a
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x40e210
mov eax, dword [esp + 8]
test eax, eax
jne 0x40e1ee
mov eax, 1
add esp, 0x114
ret
cmp eax, 1
jne 0x40e1ff
mov eax, 2
add esp, 0x114
ret
cmp eax, 2
jne 0x40e23a
mov eax, 3
add esp, 0x114
ret
cmp eax, 6
jne 0x40e23a
mov eax, dword [esp + 8]
test eax, eax
jne 0x40e229
mov eax, 4
add esp, 0x114
ret
cmp eax, 1
jne 0x40e23a
mov eax, 5
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret