joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6ac8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b14
ret

Function at 0x4f78d8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f7a50
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004f7bdc
mov esi, eax
test esi, esi
je 0x4f7936
inc dword [ebp - 0x14]
test ebx, ebx
jne 0x4f7936
mov eax, dword [edi + 0x38]
mov eax, dword [eax + 0x38]
mov edx, esi
call fcn.00423714
cmp dword [ebp - 0x18], 0
jle 0x4f7991
mov dword [ebp - 0x10], esi
inc ebx
mov eax, dword [ebp - 4]
call fcn.004067e4
cmp ebx, eax
jl 0x4f7980
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4f7890]
call fcn.004069a0
add esp, 4
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4f78b4]
call fcn.004069a0
add esp, 4
mov eax, dword [ebp - 8]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + ebx*4], edx
jmp 0x4f79c9
test ebx, ebx
jle 0x4f79c9
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
jmp 0x4f79a8
dec ebx
test ebx, ebx
jle 0x4f79a8
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4], 0
jne 0x4f79b5
test ebx, ebx
jg 0x4f799d
test ebx, ebx
jne 0x4f79c0
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4f79c9
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x64
cdq
idiv ecx
test edx, edx
jne 0x4f79ea
mov eax, dword [ebp - 0xc]
call fcn.0041d950
push edx
push eax
mov eax, dword [edi + 0x38]
call fcn.004f2c40
test esi, esi
jne 0x4f790b
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x4f7a68
call fcn.0040ba24
mov eax, dword [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, edi
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7a57
lea eax, [ebp - 0x1c]
call fcn.00405248
lea eax, [ebp - 8]
mov edx, dword [0x4f78b4]
call fcn.00406aa0
lea eax, [ebp - 4]
mov edx, dword [0x4f7890]
call fcn.00406aa0
ret
Function at 0x4fa1a0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4fa23a
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4fa1bf
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4fa250
dec edx
je 0x4fa285
jmp 0x4fa2d6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4fa2d6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fa348
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4fa367
add edx, 3
sar edx, 2
test edx, edx
jle 0x4fa475
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4fa39c
je 0x4fa3df
sub ecx, 0x2b
je 0x4fa3d5
sub ecx, 4
je 0x4fa3da
dec ecx
sub ecx, 0xa
jb 0x4fa3c7
jmp 0x4fa3e2
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4fa3ae
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4fa3b9
jmp 0x4fa3e2
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4fa3e2
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4fa3e2
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4fa3e2
mov byte [eax], 0x3e
jmp 0x4fa3e2
mov byte [eax], 0x3f
jmp 0x4fa3e2
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4fa37f
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4fa433
cmp byte [esp + 7], 0xff
jne 0x4fa433
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4fa46a
cmp dl, 0xff
je 0x4fa46a
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4fa376
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4fc870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4fc89a
mov ecx, 0x4fc8fc
mov dl, 1
mov eax, dword [0x4fbc2c]
call fcn.0040eac4
call fcn.00404bbc
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4fc8e9
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403180
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4fc8aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fc914
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4fc93e
mov ecx, 0x4fc9a8
mov dl, 1
mov eax, dword [0x4fbc2c]
call fcn.0040eac4
call fcn.00404bbc
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4fc996
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403180
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4fc950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4fcf64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fcfe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4fbf58]
mov eax, 0x14
call fcn.00406398
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409d20
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.0040529c
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x525f78]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x525f78], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfed
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040526c
ret

Function at 0x4fcff4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4fd070
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4fbf80]
mov eax, 0x10
call fcn.00406398
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409d20
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.0040529c
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x525f7c]
mov dword [ebx], eax
mov dword [0x525f7c], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd077
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040526c
ret

Function at 0x4fd0cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4fd0ed
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4fd0da
pop edi
pop esi
pop ebx
ret
Function at 0x50cf28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
dec ecx
test ecx, ecx
jb 0x50cf56
inc ecx
xor ebx, ebx
mov esi, eax
shr esi, 8
and esi, 0xffffff
mov edi, edx
add edi, ebx
xor eax, dword [edi]
and eax, 0xff
xor esi, dword [eax*4 + 0x51c2e8]
mov eax, esi
inc ebx
dec ecx
jne 0x50cf33
pop edi
pop esi
pop ebx
ret

Function at 0x50cf5c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
or ecx, 0xffffffff
dec edx
test edx, edx
jb 0x50cf88
inc edx
xor ebx, ebx
mov esi, ecx
shr esi, 8
mov edi, eax
add edi, ebx
xor ecx, dword [edi]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51c2e8]
mov ecx, esi
inc ebx
dec edx
jne 0x50cf6a
mov eax, ecx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x50d5fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
test eax, eax
je 0x50d625
test edx, edx
je 0x50d625
dec ecx
test ecx, ecx
jb 0x50d625
inc ecx
movzx ebx, byte [eax]
xor bl, 0x9e
movzx ebx, bl
movzx ebx, byte [ebx + 0x51c6e8]
xor bl, 0x34
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x50d60b
pop ebx
ret
Function at 0x10004f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, eax
add edx, 0x343faeb9
adc ecx, 0
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
mov word [esp + 0x56], 0xbf53
mov dword [esp + 0x3c], 0x5de4767d
mov si, word [esp + 0x56]
imul di, si, 0x4355
mov word [esp + 0x46], di
mov di, si
add di, 0xc662
mov word [esp + 0x32], di
mov dword [esp + 0x34], 0x103ecb8c
mov ecx, dword [esp + 0x34]
mov di, word [esp + 0x32]
cmp ecx, 0x5389857c
mov dword [esp + 0x20], eax
mov word [esp + 0x1e], si
mov dword [esp + 0x18], ecx
mov word [esp + 0x16], di
jb 0x100050a0
jmp 0x10004fe7
mov eax, dword [esp + 0x24]
cmp dword [eax], 0x4550
je 0x100050c4
jmp 0x100050c2
xor eax, eax
mov cl, byte [esp + 0x45]
and cl, byte [esp + 0x45]
mov byte [esp + 0x45], cl
mov edx, esp
mov dword [edx + 4], 0
mov dword [edx], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov dword [esp + 0x10], eax
call edx
xor edx, edx
mov byte [esp + 0x45], 0x9c
mov dword [esp + 0xc], eax
mov eax, edx
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2c]
movzx eax, word [eax]
mov cx, word [esp + 0x1e]
mov word [esp + 0x46], cx
cmp eax, 0x5a4d
jne 0x1000512a
mov ax, 0xe8d8
mov cx, word [esp + 0x56]
xor cx, 0xe901
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
sub esi, 0x7ba4b647
mov dword [esp + 0x40], esi
mov word [esp + 0x2a], cx
mov cx, word [esp + 0x1e]
or cx, 0x8a1e
mov word [esp + 0x46], cx
mov cx, word [esp + 0x1e]
add cx, 0x4be3
mov edx, dword [edx + 0x3c]
mov di, word [esp + 0x2a]
mov esi, dword [esp + 0x2c]
mov word [esp + 0x46], cx
add esi, edx
mov dword [esp + 0x24], esi
cmp ax, di
ja 0x10004fd2
jmp 0x100050c2
mov ax, word [esp + 0x56]
add ax, 0xf28f
mov cx, word [esp + 0x1e]
xor cx, 0x837d
mov word [esp + 0x46], cx
mov cx, word [esp + 0x16]
cmp ax, cx
jae 0x1000511b
jmp 0x1000512a
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
and eax, 0x61a99878
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x38]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov al, 1
test al, 1
jne 0x10005024
jmp 0x100050f8
mov ax, 0xc704
mov dword [esp + 0x40], 0x3deb7f0f
mov dword [esp + 0x38], 0
mov cx, word [esp + 0x1e]
sub ax, cx
mov word [esp + 0x46], ax
jmp 0x100050e1
lea eax, [fcn.10004f50]
mov dword [esp + 0x2c], eax
jmp 0x10005024
mov al, byte [esp + 0x45]
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x45], al
mov edx, dword [esp + 0x2c]
xor ecx, 0x5de4667d
sub edx, ecx
mov ecx, dword [esp + 0x3c]
add ecx, 0xa21b7983
and edx, ecx
mov al, byte [esp + 0x45]
shl al, 6
mov byte [esp + 0x45], al
mov dword [esp + 0x2c], edx
jmp 0x100050ec
Function at 0x100059b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10025457]
mov esi, 0x18
lea edi, [esp + 0x4c]
mov bx, word [esp + 0x92]
mov word [esp + 0x92], 0
mov word [esp + 0x90], 0x5b68
mov dword [esp + 0x44], eax
mov al, byte [esp + 0x87]
mov ah, 0xea
mov byte [esp + 0x43], al
mul ah
mov byte [esp + 0x87], al
mov eax, esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
mov word [esp + 0x32], bx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
call fcn.10005850
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0x5f3b475b
mov bx, word [esp + 0x32]
and bx, 0xe59e
mov word [esp + 0x92], bx
mov esi, dword [esp + 0x24]
mov dword [esp], esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp + 8], 0x18
mov byte [esp + 0x23], al
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
call fcn.10005870
lea ecx, [esp + 0x4c]
mov dword [esp], ecx
call fcn.10005bf0
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x7c], eax
cmp dword [esp + 0x7c], 0
mov dword [esp + 0x14], ecx
jne 0x10005aeb
jmp 0x10005b54
mov eax, dword [esp + 0x1c]
add eax, 0x2f207d4d
mov ecx, dword [esp + 0x18]
adc ecx, 0
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov eax, dword [esp + 0x78]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ax, word [esp + 0x32]
or ax, 0x8649
mov word [esp + 0x92], ax
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x74], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
call fcn.10006460
mov dx, ax
mov word [esp + 0x70], dx
mov word [esp + 0x72], dx
mov dx, word [esp + 0x32]
xor dx, 0xffff
mov word [esp + 0x92], dx
movzx eax, word [esp + 0x72]
cmp eax, 0
jne 0x10005b6c
mov eax, dword [esp + 0x14]
sub eax, 0x354be77e
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], 0
jmp 0x10005ac1
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0x3e86608b
jmp 0x10005ac1
lea eax, [esp + 0x70]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], 0
mov edx, dword [esp + 0x7c]
mov bl, byte [esp + 0x43]
add bl, bl
mov si, word [esp + 0x90]
mov byte [esp + 0x87], bl
mov edi, dword [ebp + 8]
add si, 0xa498
mov dword [esp + 0x80], 0x765bfa3a
mov dword [esp], edi
mov dword [esp + 4], eax
movzx eax, si
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call edx
sub esp, 0x10
mov ecx, dword [esp + 0x14]
and ecx, 0xb9c1ce3
mov dword [esp + 0x80], ecx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x78], eax
jmp 0x10005ac1
Function at 0x408914
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 8], eax
call fcn.00419b27
mov esi, eax
test esi, esi
js 0x4089cf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.00419b27
mov esi, eax
test esi, esi
jne 0x4089cb
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
push 0x2f
pop edx
cmp dx, cx
je 0x408983
push 0x2d
pop edx
cmp dx, cx
jne 0x4089e5
lea esi, [eax + 2]
push esi
push 0x40186c
call edi
test eax, eax
jne 0x40899d
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x4089af
push esi
push 0x401884
call edi
test eax, eax
jne 0x4089ec
mov dword [ebx], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.00419b27
mov esi, eax
test esi, esi
je 0x40896d
test esi, esi
js 0x4089cf
xor esi, esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4089dc
push eax
call fcn.00417131
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
mov esi, 0x80070057
jmp 0x4089d2
push esi
push 0x4018a4
call edi
mov esi, 0x80070057
jmp 0x4089cf
Function at 0x40dcd7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 8], ebx
cmp dword [edi + 0x44], ebx
je 0x40dcf4
xor esi, esi
inc esi
jmp 0x40def1
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x40dd49
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
js 0x40def1
lea eax, [ebp + 8]
push eax
push 2
push ebx
push dword [edi + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40dd39
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40def1
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x48]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x401f80
push ecx
call ebx
mov esi, eax
test esi, esi
jle 0x40dd7a
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x401f8c
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40ddae
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x74]
push eax
push 4
push 0
push 0x401fa0
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40dddc
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x70]
push eax
push 4
push 0
push 0x401fc0
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40de0a
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x401fe0
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40de38
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x5c]
push eax
push 4
push 0
push 0x401ff4
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40de66
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x60]
push eax
push 4
push 0
push 0x40200c
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40de90
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x64]
push eax
push 4
push 0
push 0x402028
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40deba
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40dee2
push 4
lea eax, [edi + 0x68]
push eax
push 4
push 0
push 0x402040
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jle 0x40dee2
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 8], 0
je 0x40def1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x40f495
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x116c
call fcn.0041128b
mov eax, dword [0x42104c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
push 0x1154
mov dword [ebp - 0x116c], eax
lea eax, [ebp - 0x1158]
push edi
push eax
mov dword [ebp - 0x115c], edi
mov dword [ebx], edi
call fcn.00411211
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x1150]
push 0x80
push eax
mov dword [ebp - 0x1158], 0x1154
mov dword [ebp - 0x1154], 7
call fcn.00411144
add esp, 0x1c
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x1050]
push eax
push edi
push edi
push 0x40211c
push dword [ebp - 0x1164]
mov dword [ebp - 0x1160], 0x1048
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40f556
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40f5cd
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x4017a8
push dword [ebp - 0x1164]
mov dword [ebp - 0x1160], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40f594
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40f5cd
lea eax, [ebp - 0x115c]
push eax
push dword [ebp - 0x116c]
lea eax, [ebp - 0x1158]
push eax
push dword [ebp - 0x1168]
call fcn.0040f41e
mov esi, eax
test esi, esi
js 0x40f5cd
mov eax, dword [ebp - 0x115c]
mov dword [ebx], eax
mov dword [ebp - 0x115c], edi
mov esi, edi
jmp 0x40f5d3
mov edi, dword [ebp - 0x115c]
test edi, edi
je 0x40f5e8
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
add eax, 4
add eax, edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410f5c
leave
ret 0x14