joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58edfd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6369e8], 0
push esi
jne 0x58ed70
call fcn.0058ec96
test eax, eax
je 0x58edb3
mov eax, dword [0x6369e8]
cmp eax, 1
jne 0x58ed91
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x58edb3
pop esi
ret
push eax
call dword [0x6369f0]
test eax, eax
jne 0x58edfb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x58edb7
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x6369e8]
call dword [0x6369f0]
mov edi, eax
test edi, edi
je 0x58eddc
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x58edf8
mov edi, esi
add esi, 0xff0
push edi
push dword [0x6369e8]
call dword [0x6369ec]
add edi, 0x10
cmp edi, esi
jb 0x58ede4
mov eax, edi
pop edi
pop esi
ret
jmp 0x58ed5d

Function at 0x58f3cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x61dc40]
jne 0x58f3d9
repz ret
jmp fcn.0059b9c9

Function at 0x5aaa36
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0059cfe6
and dword [ebp - 4], 0
cmp dword [0x637550], 0
mov ebx, eax
jne 0x5aaae7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5aab98
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5aab98
push eax
call fcn.0059cf74
mov dword [esp], 0x5cfd78
push edi
mov dword [0x637550], eax
call esi
push eax
call fcn.0059cf74
mov dword [esp], 0x5cfd64
push edi
mov dword [0x637554], eax
call esi
push eax
call fcn.0059cf74
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x637558], eax
call esi
push eax
call fcn.0059cf74
pop ecx
mov dword [0x637560], eax
test eax, eax
je 0x5aaae7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0059cf74
pop ecx
mov dword [0x63755c], eax
mov eax, dword [0x63755c]
cmp eax, ebx
je 0x5aab3f
cmp dword [0x637560], ebx
je 0x5aab3f
push eax
call fcn.0059cff2
push dword [0x637560]
mov esi, eax
call fcn.0059cff2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5aab3f
test edi, edi
je 0x5aab3f
call esi
test eax, eax
je 0x5aab36
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5aab36
test byte [ebp - 0xc], 1
jne 0x5aab3f
or dword [ebp + 0x10], 0x200000
jmp 0x5aab78
mov eax, dword [0x637554]
cmp eax, ebx
je 0x5aab78
push eax
call fcn.0059cff2
pop ecx
test eax, eax
je 0x5aab78
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5aab78
mov eax, dword [0x637558]
cmp eax, ebx
je 0x5aab78
push eax
call fcn.0059cff2
pop ecx
test eax, eax
je 0x5aab78
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x637550]
call fcn.0059cff2
pop ecx
test eax, eax
je 0x5aab98
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5aab9a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401390
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x4013b0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push edi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x4013e0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4013f2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4019a0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x409088]
xor eax, dword [esp + 0x14]
push esi
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push str.hpodcore3.hpodcore3
mov esi, ecx
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jl 0x4019df
add esi, 0xc
push esi
push 0x40730c
push 0x17
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x14]
xor ecx, dword [esp + 0x18]
pop esi
add esp, 0x14
jmp fcn.00405e0f
Function at 0x402540
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x409088]
xor eax, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x12c], eax
mov eax, dword [edi]
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
jne 0x4025b1
test ecx, ecx
je 0x4025a3
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], ecx
je 0x4025bf
test ecx, ecx
je 0x40266b
push ecx
jmp 0x402665
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x402632
jmp 0x4025f0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.00402540
mov edi, eax
test edi, edi
jne 0x40268b
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x4025f0
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x402649
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x128]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x40266b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x120]
xor ecx, dword [esp + 0x124]
pop edi
pop esi
call fcn.00405e0f
add esp, 0x11c
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x40269a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40266d
Function at 0x4047c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40651b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
mov eax, dword [0x409088]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x409020]
mov dword [ebp - 0x1c], esi
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x424], esi
mov edi, dword [ebp + 8]
cmp edi, esi
mov dword [ebp - 4], esi
je 0x40484b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.00405e80
mov esi, esp
test esi, esi
mov dword [ebp - 0x10], esp
je 0x40484b
mov eax, dword [ebp - 0x18]
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x40486b
call fcn.004012a0
mov esi, eax
jmp 0x40493e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x40488a
call fcn.004012a0
jmp 0x404935
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
mov dword [ebp + 0x10], esi
jne 0x4048a5
call fcn.004012a0
jmp 0x404935
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, 0x400
mov dword [ebp + 0xc], ebx
mov byte [ebp - 4], 1
jbe 0x4048d4
push eax
lea ecx, [ebp - 0x424]
call fcn.00401970
jmp 0x4048eb
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x4048eb
mov eax, dword [ebp - 0x424]
test eax, eax
mov dword [ebp - 4], 0
jne 0x404903
mov esi, 0x8007000e
jmp 0x404937
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x14]
mov byte [ebx + eax], 0
mov edx, dword [ebp - 0x424]
push ecx
push edx
lea ecx, [ebp - 0x20]
call fcn.00403c10
mov edi, dword [ebp + 8]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
cmp ecx, eax
je 0x404959
lea ecx, [ebp - 0x424]
call fcn.00401960
mov eax, esi
lea esp, [ebp - 0x430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp + 4]
call fcn.00405e0f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405800
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0
push 4
push 0x40917c
mov esi, ecx
call fcn.00405110
mov edi, eax
test edi, edi
jne 0x405854
mov al, byte [esi + 0x3c]
test al, al
je 0x405858
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x30], eax
je 0x405849
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x405200
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x405858
pop edi
mov eax, 0x80004005
pop esi
pop ecx
ret 4
mov byte [esi + 0x3c], 0
mov eax, edi
pop edi
pop esi
pop ecx
ret 4
Function at 0x406034
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x407b08
call fcn.00406220
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406071
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406071
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406089
cmp eax, 0x20b
je 0x406076
mov dword [ebp - 0x1c], ebx
jmp 0x40609d
cmp dword [ecx + 0x84], 0xe
jbe 0x406071
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x406097
cmp dword [ecx + 0x74], 0xe
jbe 0x406071
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR70.dll___set_app_type]
pop ecx
or dword [0x4091b8], 0xffffffff
or dword [0x4091bc], 0xffffffff
call dword [sym.imp.MSVCR70.dll___p__fmode]
mov ecx, dword [0x4091b0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR70.dll___p__commode]
mov ecx, dword [0x4091ac]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR70.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4091b4], eax
call fcn.004062e6
call fcn.00406386
cmp dword [0x4090b0], ebx
jne 0x4060fd
push fcn.00406386
call dword [sym.imp.MSVCR70.dll___setusermatherr]
pop ecx
call fcn.00406374
push 0x40901c
push 0x409018
call sub.MSVCR70.dll__initterm
push 0x40632a
call fcn.00406022
mov eax, dword [0x4091a8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x4091a4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR70.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp eax, ebx
jge 0x406151
push 8
call sub.MSVCR70.dll__amsg_exit
pop ecx
push 0x409014
push section..data
call sub.MSVCR70.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR70.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x4061ab
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40617f
cmp al, 0x22
jne 0x406171
cmp byte [esi], 0x22
jne 0x406188
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x406192
cmp al, 0x20
jbe 0x406184
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x4061b6
movzx eax, word [ebp - 0x48]
jmp 0x4061b9
cmp byte [esi], 0x20
jbe 0x406188
inc esi
mov dword [ebp - 0x34], esi
jmp 0x4061ab
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00405c50
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4061d6
push esi
call dword [sym.imp.MSVCR70.dll_exit]
call dword [sym.imp.MSVCR70.dll__cexit]
jmp 0x40620b
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040625b
ret
Function at 0x466612
Capabilities:
Encode data using base64

Disassembly:
test si, ax
bts ecx, ebp
bt ebp, ecx
mov ecx, dword [esi + 0x7c]
stc
cmp dl, dl
cmp dl, ah
add ecx, edx
jmp 0x4a72e2
mov dword [ebp - 0x10], ecx
cmc
mov ecx, dword [ebp + 0xc]
push edi
cmp ecx, 0xffff
mov byte [esp + 4], bh
pushal
call fcn.0049d655

Function at 0x468ffc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x468fdf
mov dword [esp + 0x38], 0x499f07
call fcn.0049a67f
add byte [eax], al
push ebx
je 0x469034
jb 0x469069
jae 0x46905e
dec edi
jb 0x469060
inc ebp
js 0x468ffc
cmc
test eax, eax
mov byte [esp], ch
mov word [esp], 0x99cb
lea esp, [esp + 8]
je 0x4697fb
clc
pushfd
neg si
mov esi, dword [eax + 0x3c]
rol edx, cl
add esi, eax
sub dh, 0xd1
add dl, 0xff
not dl
mov dh, al
mov edx, dword [esi + 0x78]
bt bp, si
bt ebp, esi
add esp, 4
jae 0x49780b
shl edi, cl
add al, byte [eax]
pushfd
test edx, edx
mov byte [esp], 0x55
call fcn.004a394b
add eax, 0x68cad260
jg 0x46902c
in eax, 0x14
movsx ax, dl
bswap ax
push esi
push 0xa8b53e07
lahf
cwde
mov dword [esp], edi
cwde
pushfd
push 0xdb96fd13
mov dword [esp + 4], edx
pop eax
push eax
mov eax, 0xf4d8
pushal
pushal
xchg dword [esp + 0x40], eax
cwde
jmp 0x497374
mov dword [esp + 0x3c], 0
cwde
pop eax
movsx eax, dl
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
push 0x964dc7b7
jmp 0x4a5e94
cmc
clc
pushfd
test edx, edx
jmp 0x4a56b2
lea esp, [esp + 0x44]
jge 0x4971d3
push esi
not al
lea eax, [ebx*8 - 0x72359a91]
pushal
mov dword [esp + 0x1c], edi
not ax
pushfd
push 0x2e26122a
mov dword [esp + 0x20], edx
lahf
mov ah, ah
mov eax, 0xf4d8
pushal
mov dword [esp + 0x3c], eax
pop eax
mov dword [esp + 0x34], 0
mov dword [esp], 0x2432efb9
push dword [esp]
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
jmp 0x4a9b4c
lea esp, [esp + 4]
je 0x4697fb
bsr cx, bx
dec ecx
rcr cx, cl
add edx, eax
shr cl, 1
sbb ch, bh
mov ecx, dword [esi + 0x7c]
call fcn.00466f07
push ebx
jmp 0x4689c4

Function at 0x4983d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], ebx
jmp 0x4a6081
pushfd
test eax, eax
pushal
lea esp, [esp + 0x24]
shrd ax, bx, cl
push edx
stc
mov eax, dword [ebp + 8]
cmc
clc
jmp 0x49dfa6

Function at 0x498642
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
lea esp, [esp + 0x2c]
je 0x4697fb
clc
push ebx
cmc
add eax, edi
cmc
test bh, 0x78
pushal
mov word [esp], bx
cmp eax, edx
call fcn.00499d88
add byte [eax], al
inc edi
je 0x4986ba
jns 0x4986dc
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x4986b1
jb 0x4986e6
jae 0x4986db
add byte [ebx - 0x6363f807], al
mov edx, 0x427cccaa
ret 0xab5e
cmp ebp, ecx
xor cl, bh
sub eax, 0x361c5bbc
pop edx
jbe 0x49865c
mov word [ecx - 0x6f], gs
mov bl, 0x52
mov bl, 0x52
arpl word [edi + esi*8 - 0x16281c70], di
outsb dx, byte [esi]
out dx, eax
and dword [ebx + 0x19babdd8], 0xffffffb5
mov ch, 0x26
ljmp 0x42c1
ljmp 0x42c1:0xbadfaa80
nop
jge 0x4986ca
sahf
push ecx
and al, 0x23
adc byte [edx], dl
adc dword [edx + 0x3e], 0x73
invalid

Function at 0x499d88
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0x28]
jb 0x46980b
push 0x7899698c
pushfd
Function at 0x49a5eb
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x4697fb
clc
movzx esi, dl
sbb cx, 0x4079
mov ecx, edi
cmc
btc esi, 0x13
not esi
sub ecx, ebx
bts esi, ebp
shrd esi, edi, 4
xor si, 0xaa0d
mov esi, esp

Function at 0x4a5822
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jne 0x4974cd
setp ah
bsf ax, bp
sub edx, edx
lahf
mov eax, edx
push 0x3cfe8a28
push edi
lea esp, [esp + 8]
jmp 0x49d70b

Function at 0x4a661a
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
test ch, 0xed
test al, al
call fcn.004a98da

Function at 0x4a72fa
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jbe 0x4982c3
mov cl, 0x85
clc
bsr cx, sp
mov edi, dword [edx + 0x24]
bts bx, 0xe
rcl ebx, 0x17
and cl, bh
add edi, eax
neg ch
clc
xor ch, 0x3f
mov ebx, dword [edx + 0x20]
cmp ebx, ebx
or cl, 0xb5
add ebx, eax
neg ch
mov dword [ebp - 8], 0
movsx ecx, al
call fcn.004a57c0
Function at 0x4014b5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov dword [esp + 4], 0x406018
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
cmp dword [0x404044], 0x4909da78
jne 0x401507
mov eax, dword [0x40405c]
mov dword [esp], eax
call fcn.00402239
mov word [ebx], 0x17
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402ab1
mov dword [esi + 0x6c], eax
mov dword [esp + 4], 0x406031
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 0xc
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00402ab1
mov dword [esi + 0x74], eax
mov dword [esp + 4], 0x406042
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 0xf
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00402ab1
mov dword [esi + 0x78], eax
mov dword [esp + 4], 0x406053
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 9
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00402ab1
mov dword [esi + 0x7c], eax
mov dword [esp + 4], 0x406064
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 0xd
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00402ab1
mov dword [esi + 0x80], eax
mov dword [esp + 4], 0x406075
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 0x14
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402ab1
mov dword [esi + 0x68], eax
mov dword [esp + 4], 0x40608e
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.004035f1
mov word [ebx], 0x13
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402ab1
mov dword [esi + 0x70], eax
mov dword [esp], esi
call fcn.00401ad1
test eax, eax
je 0x4016a9
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call dword [esi + 0x74]
sub esp, 0x1c
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
sete dl
cmp eax, 0xffffffff
sete al
or eax, edx
test al, 1
je 0x4016c2
call sub.msvcrt.dll_abort
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1000
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00402269
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401975
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov dword [esp + 0x10], 0x793316a7
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov eax, dword [0x404094]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], ebx
call sub.USER32.dll_MessageBeep
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.USER32.dll_GetClassNameW
sub esp, 0xc
mov eax, esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401ad1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x48]
mov dword [esp + 4], 0x4060a7
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.004019d1
cmp word [ebx], 0
je 0x401b5b
cld
mov dword [ebp - 0x44], ebx
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x401b1b
mov esi, dword [ebp - 0x44]
lea edi, [ebp - 0x38]
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
jne 0x401b55
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x401b8e
cmp word [ebx], 0
jne 0x401b18
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x18]
cmp eax, dword [edx + 8]
jne 0x401b7a
mov eax, dword [ecx + 0x28]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x401b8e
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
jne 0x401b5b
mov eax, 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4023be
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
sub esp, 8
mov dword [esp + 4], 0x51c06187
mov dword [esp], 0x26bb90e6
call fcn.004020ae
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
sub esp, 8
imul eax, dword [0x404060], 0x8cacb0f
add eax, ebx
test eax, eax
setne al
test esi, esi
setne dl
movzx eax, al
and eax, edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4028ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x31e84e1c
mov dword [esp], 0x1199ac87
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret