joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e550
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x417c47
cmp dword [esi + 8], 0x4f
je 0x417c5f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x417c66
cmp dword [esi + 8], 0x4e
jne 0x417c66
xor eax, eax
jmp 0x417d36
cmp dword [esi + 4], 0x100
jne case.0x417c81.113
mov eax, dword [esi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja case.0x417c81.113
movzx eax, byte [eax + 0x417d60]
jmp dword [eax*4 + 0x417d54]
mov eax, dword [edi + 0x5c]
mov al, byte [eax + 0xa1]
test al, al
jne case.0x417c81.112
mov ecx, edi
call fcn.004175a0
mov eax, 1
jmp 0x417d36
mov edx, esi
lea ecx, [ebp - 0x30]
call fcn.00412db0
push eax
push 0xa
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00417f60
cmp dword [ebp - 0x1c], 0x10
jb 0x417cd2
push dword [ebp - 0x30]
call fcn.00425576
add esp, 4
mov eax, 1
jmp 0x417d36
mov ecx, dword [edi + 0x60]
test ecx, ecx
je 0x417c5f
mov dword [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
push 0x4403d8
push ecx
call dword [eax]
test eax, eax
js 0x417d1e
mov eax, dword [ebp - 0x18]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x417d1e
cmp eax, 1
je 0x417d1e
mov esi, 1
jmp 0x417d20
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x417d34
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424db6
mov esp, ebp
pop ebp
ret 4
Function at 0x418800
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x38], edx
mov esi, ecx
mov dword [ebp - 0x3c], eax
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x7f00
push 0
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0x418760
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], str.LIEFrameControl
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push 0
push 0
push 0
push 0x64
push 0x64
push 0
push 0
push 0
push str.IE_Message_Window
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x44f8c0
je 0x4188cf
push 0xffffffffffffffff
push 0
push ebx
mov ecx, 0x44f8c0
call fcn.00405930
push 0
push 0
push 0
push 0x418720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov edx, edi
mov esi, eax
call fcn.00417d70
add esp, 4
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424db6
mov esp, ebp
pop ebp
ret

Function at 0x41ba20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x452c74], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x452c74], edx
inc eax
cmp eax, 0x270
jl 0x41ba31
mov dword [0x452c70], 0x270
pop ebp
ret 8

Function at 0x41f7f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push eax
mov esi, ecx
call fcn.00429ef0
add esp, 0xc
lea eax, [ebp - 0x44]
push 0x1f
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x44], ax
jne 0x41f84a
xor ecx, ecx
jmp 0x41f85f
lea ecx, [ebp - 0x44]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f850
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.004074e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00424db6
mov esp, ebp
pop ebp
ret
Function at 0x41fa30
Capabilities:
Check if file exists
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43eed6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x44e740]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebx], vtable.NamedPipeMessenger.0
push 0xffffffffffffffff
lea edi, [ebx + 4]
mov dword [edi + 0x14], 7
mov ecx, edi
push eax
push dword [ebp + 8]
mov dword [edi + 0x10], 0
mov word [edi], ax
call fcn.00405930
lea esi, [ebx + 0x1c]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
mov edx, 0x447ae4
mov byte [ebx + 0x34], al
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x74], 0
call fcn.0041e000
mov edi, eax
add esp, 4
cmp esi, edi
je 0x41faff
cmp dword [esi + 0x14], 8
jb 0x41fae4
push dword [esi]
call fcn.00425576
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.004057c0
cmp dword [ebp - 0x18], 8
jb 0x41fb10
push dword [ebp - 0x2c]
call fcn.00425576
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [ebx + 0x48], eax
call edi
push 0
push 0
push 0
push 0
mov dword [ebx + 0x5c], eax
call edi
cmp byte [ebx + 0x34], 0
mov dword [ebx + 0x70], eax
je 0x41fb72
cmp dword [esi + 0x14], 8
jb 0x41fb4b
mov esi, dword [esi]
push dword [ebp + 0x18]
push 0
push 0x800
push 0x800
push 0xff
push 6
push 0x40080003
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebx + 0x44], eax
jmp 0x41fbb9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp eax, 2
jne 0x41fb86
push 0x3e8
call edi
cmp dword [esi + 0x14], 8
jb 0x41fb90
mov eax, dword [esi]
jmp 0x41fb92
mov eax, esi
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41fb7f
push 0
push 0
push ebx
push 0x41fa10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x40], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41fcc0
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ef08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44e740]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x44e740]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x34], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi + 0x74], 1
je 0x41fd45
lea eax, [edi + 0x4c]
mov dword [edi + 0x54], 0
push eax
push dword [edi + 0x44]
mov dword [edi + 0x58], 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, eax
call ebx
test esi, esi
jne 0x41fd45
cmp eax, 0x217
je 0x41fd45
cmp eax, 0x3e5
jne 0x41fd45
push 0xffffffffffffffff
push dword [edi + 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, edi
mov dword [esp + 0x14], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
push 0x401
mov dword [esp + 0x44], 0
call fcn.004212ec
add esp, 4
mov esi, eax
push 0
lea eax, [esp + 0x18]
push eax
push 0x400
push esi
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
cmp eax, 6
je 0x41fdf4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41fdfc
cmp byte [esi + eax - 1], 0
mov byte [esi + 0x400], 0
sete bl
cmp byte [esi], 0
jne 0x41fdcf
xor eax, eax
jmp 0x41fddd
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fdd4
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00405550
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x41fdfc
jmp 0x41fd92
mov dword [esp + 0x14], 0
push esi
call fcn.004259b4
add esp, 4
cmp dword [esp + 0x14], 0
je 0x41fe38
push dword [edi + 0x3c]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x38]
call eax
add esp, 8
cmp dword [esp + 0x2c], 0x10
jb 0x41fd50
push dword [esp + 0x18]
call fcn.00425576
add esp, 4
jmp 0x41fd50
cmp dword [esp + 0x2c], 0x10
jb 0x41fe4b
push dword [esp + 0x18]
call fcn.00425576
add esp, 4
mov byte [edi + 0x74], 0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00424db6
mov esp, ebp
pop ebp
ret
Function at 0x41fe70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
jb 0x41fea0
mov ecx, dword [ecx]
lea edi, [esi + 0x60]
inc eax
push edi
lea edx, [ebp - 8]
push edx
push eax
push ecx
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41fee0
push 0xffffffffffffffff
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41fee0
push 1
lea eax, [ebp - 8]
push eax
push edi
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00424db6
mov esp, ebp
pop ebp
ret 4
Function at 0x4204e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x40
jb 0x4204f7
mov eax, 0x10
pop esi
pop ebp
ret
lea eax, [ecx*8]
add dword [esi], eax
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x20], 0x80
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jbe 0x420541
cmp eax, 0x40
jae 0x420530
lea esp, [esp]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jb 0x420520
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.00420040
mov dword [esi + 0x1c], 0
cmp dword [esi + 0x1c], 0x38
jae 0x420561
jmp 0x420550
mov eax, dword [esi + 0x1c]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
cmp dword [esi + 0x1c], 0x38
jb 0x420550
movzx eax, byte [esi + 7]
lea edx, [esi + 0x20]
mov byte [esi + 0x58], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x59], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x5d], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5e], al
movzx eax, byte [esi]
mov byte [esi + 0x5f], al
call fcn.00420040
mov ecx, dword [ebp + 0xc]
movzx eax, byte [esi + 0xb]
mov byte [ecx], al
movzx eax, byte [esi + 0xa]
mov byte [ecx + 1], al
movzx eax, byte [esi + 9]
mov byte [ecx + 2], al
movzx eax, byte [esi + 8]
mov byte [ecx + 3], al
movzx eax, byte [esi + 0xf]
mov byte [ecx + 4], al
movzx eax, byte [esi + 0xe]
mov byte [ecx + 5], al
movzx eax, byte [esi + 0xd]
mov byte [ecx + 6], al
movzx eax, byte [esi + 0xc]
mov byte [ecx + 7], al
movzx eax, byte [esi + 0x13]
mov byte [ecx + 8], al
movzx eax, byte [esi + 0x12]
mov byte [ecx + 9], al
movzx eax, byte [esi + 0x11]
mov byte [ecx + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [ecx + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [ecx + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [ecx + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [ecx + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [ecx + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [ecx + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [ecx + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [ecx + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [ecx + 0x13], al
xor eax, eax
pop esi
pop ebp
ret
Function at 0x420730
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ef40
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], edx
mov eax, ecx
mov dword [ebp - 0x24], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocString
push eax
mov dword [ebp - 0x18], edi
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42078e
xor eax, eax
jmp 0x42081f
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4207ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4207b4
xor edi, edi
jmp 0x420806
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
push eax
call fcn.00426a8d
add esp, 4
mov esi, eax
test esi, esi
je 0x4207f7
push 0
lea eax, [ebp - 0x18]
mov byte [edi + esi], 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42083b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x420840
push dword [ebp - 0x24]
push str.Failed_to_read_from_file:__s
call fcn.00401320
add esp, 8
xor edi, edi
test esi, esi
je 0x420806
push esi
call fcn.00425576
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42081d
test ebx, ebx
je 0x42081d
push ebx
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424db6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], edi
jne 0x4207e7
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov edi, esi
jmp 0x420806
Function at 0x4391c7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44e740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042a0db
mov dword [ebp - 0x14], eax
cmp dword [0x45178c], esi
jne 0x4392ba
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x439247
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43939a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43939a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43939a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45178c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x451790], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x451794], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45179c], eax
test eax, eax
je 0x4392b7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x451798], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4392df
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4392d2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4392f4
push 4
pop eax
jmp 0x43939c
cmp dword [ebp - 0x14], esi
je 0x4392f4
push dword [0x45178c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4392d9
mov eax, dword [0x451798]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x439352
cmp dword [0x45179c], edi
je 0x439352
push eax
call ebx
push dword [0x45179c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x439352
test eax, eax
je 0x439352
call ecx
test eax, eax
je 0x439347
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x439347
test byte [ebp - 8], 1
jne 0x439352
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x439382
mov eax, dword [0x451790]
cmp eax, edi
je 0x43937f
push eax
call ebx
test eax, eax
je 0x43937f
call eax
mov esi, eax
test esi, esi
je 0x43937f
mov eax, dword [0x451794]
cmp eax, edi
je 0x43937f
push eax
call ebx
test eax, eax
je 0x43937f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45178c]
call ebx
test eax, eax
je 0x43939a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43939c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424db6
mov esp, ebp
pop ebp
ret
Function at 0x6da31110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6da4dc8c]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.6da3ca40
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6da311bc
cmp eax, 0x104
ja 0x6da311bc
push 0x103
lea edx, [esp + 0x10d]
push 0
push edx
mov byte [esp + 0x114], 0
call fcn.6da3ca40
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push 0x6da46660
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6da3ca24
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.6da3ca24
add esp, 0x20c
ret
Function at 0x6da328b0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x6da328f0
push str.Advapi32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x6da328fd
push str.RegDeleteKeyTransactedA
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x6da328fd
mov ecx, dword [esi]
mov edx, dword [esp + 0xc]
push 0
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push edx
push ecx
call eax
pop esi
ret 8
cmp dword [esi + 4], 0
je 0x6da328fd
pop esi
jmp dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
pop esi
ret 8

Function at 0x6da32b60
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6da32b80
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x6da32b94
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x6da32bc0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x6da32bd6
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6da32be3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x6da33450
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
mov eax, dword [0x6da4dc8c]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.6da32ae0
mov ebx, eax
cmp ebx, esi
je 0x6da334b5
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x6da334ae
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x6da33551
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
push eax
mov dword [esp + 0x3c], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x6da3351c
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.6da33450
mov ebx, eax
cmp ebx, esi
jne 0x6da3356b
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
push edx
mov dword [esp + 0x3c], pe_nt_image_headers32
call ebp
test eax, eax
je 0x6da334e2
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x6da33531
push eax
call ebx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x20]
push eax
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.6da32980
mov edi, eax
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x6da3354e
push eax
call ebx
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.6da3ca24
add esp, 0x120
ret 4
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x6da3357a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x6da33550